From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Sun, 28 Dec 2008 21:08:13 +0000 (+0000)
Subject: STABLE14-rx-rdwr-writeproc-race-20081228
X-Git-Tag: openafs-stable-1_4_9pre1~77
X-Git-Url: https://git.michaelhowe.org/gitweb/?a=commitdiff_plain;h=28e124c692db615859aeaea148effc764767f440;p=packages%2Fo%2Fopenafs.git

STABLE14-rx-rdwr-writeproc-race-20081228

LICENSE MIT
FIXES 123799

prevent rx_WriteProc() from passing a packet to rxi_PrepareSendPacket()
that has been freed and possibly allocated to another call.


(cherry picked from commit d0cc6eb2f5f0aea0a6ad88de2d847f93d07cc8b9)
---

diff --git a/src/rx/rx_rdwr.c b/src/rx/rx_rdwr.c
index bcaa11870..a3542e602 100644
--- a/src/rx/rx_rdwr.c
+++ b/src/rx/rx_rdwr.c
@@ -690,6 +690,12 @@ rxi_WriteProc(register struct rx_call *call, register char *buf,
     do {
 	if (call->nFree == 0) {
 	    if (!call->error && cp) {
+                /* Clear the current packet now so that if
+                 * we are forced to wait and drop the lock 
+                 * the packet we are planning on using 
+                 * cannot be freed.
+                 */
+		call->currentPacket = (struct rx_packet *)0;
 #ifdef AFS_GLOBAL_RXLOCK_KERNEL
 		/* Wait until TQ_BUSY is reset before adding any
 		 * packets to the transmit queue
@@ -711,7 +717,7 @@ rxi_WriteProc(register struct rx_call *call, register char *buf,
 		hadd32(call->bytesSent, cp->length);
 		rxi_PrepareSendPacket(call, cp, 0);
 		queue_Append(&call->tq, cp);
-		cp = call->currentPacket = NULL;
+		cp = NULL;
 		if (!
 		    (call->
 		     flags & (RX_CALL_FAST_RECOVER |