From 28e124c692db615859aeaea148effc764767f440 Mon Sep 17 00:00:00 2001 From: Jeffrey Altman Date: Sun, 28 Dec 2008 21:08:13 +0000 Subject: [PATCH] STABLE14-rx-rdwr-writeproc-race-20081228 LICENSE MIT FIXES 123799 prevent rx_WriteProc() from passing a packet to rxi_PrepareSendPacket() that has been freed and possibly allocated to another call. (cherry picked from commit d0cc6eb2f5f0aea0a6ad88de2d847f93d07cc8b9) --- src/rx/rx_rdwr.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/rx/rx_rdwr.c b/src/rx/rx_rdwr.c index bcaa11870..a3542e602 100644 --- a/src/rx/rx_rdwr.c +++ b/src/rx/rx_rdwr.c @@ -690,6 +690,12 @@ rxi_WriteProc(register struct rx_call *call, register char *buf, do { if (call->nFree == 0) { if (!call->error && cp) { + /* Clear the current packet now so that if + * we are forced to wait and drop the lock + * the packet we are planning on using + * cannot be freed. + */ + call->currentPacket = (struct rx_packet *)0; #ifdef AFS_GLOBAL_RXLOCK_KERNEL /* Wait until TQ_BUSY is reset before adding any * packets to the transmit queue @@ -711,7 +717,7 @@ rxi_WriteProc(register struct rx_call *call, register char *buf, hadd32(call->bytesSent, cp->length); rxi_PrepareSendPacket(call, cp, 0); queue_Append(&call->tq, cp); - cp = call->currentPacket = NULL; + cp = NULL; if (! (call-> flags & (RX_CALL_FAST_RECOVER | -- 2.39.5