hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-16 15:44:04 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

In sbflush(), don't exit the while loop too early: this can cause

Browse Source 
an empty mbuf to stay in the queue, then causing a needless panic
because sb_cc == 0 and sb_mbcnt != 0.

But we still need to panic rather than endlessly looping if, for
some reason, sb_cc == 0 and there are non-empty mbufs in the queue.

PR:		kern/11988
Reviewed by:	fenner
This commit is contained in:
Pierre Beyssac 1999-09-28 12:59:18 +00:00
parent 1ab305ef60
commit 23f84772ca
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=51757
2 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/kern/uipc_sockbuf.c
View File

@ -730,8 +730,15 @@ sbflush(sb)
if (sb->sb_flags & SB_LOCK)
panic("sbflush: locked");
while (sb->sb_mbcnt && sb->sb_cc)
while (sb->sb_mbcnt) {
/*
* Don't call sbdrop(sb, 0) if the leading mbuf is non-empty:
* we would loop forever. Panic instead.
*/
if (!sb->sb_cc && (sb->sb_mb == NULL || sb->sb_mb->m_len))
break;
sbdrop(sb, (int)sb->sb_cc);
}
if (sb->sb_cc || sb->sb_mb || sb->sb_mbcnt)
panic("sbflush: cc %ld || mb %p || mbcnt %ld", sb->sb_cc, (void *)sb->sb_mb, sb->sb_mbcnt);
}

9
sys/kern/uipc_socket2.c
View File

@ -730,8 +730,15 @@ sbflush(sb)
if (sb->sb_flags & SB_LOCK)
panic("sbflush: locked");
while (sb->sb_mbcnt && sb->sb_cc)
while (sb->sb_mbcnt) {
/*
* Don't call sbdrop(sb, 0) if the leading mbuf is non-empty:
* we would loop forever. Panic instead.
*/
if (!sb->sb_cc && (sb->sb_mb == NULL || sb->sb_mb->m_len))
break;
sbdrop(sb, (int)sb->sb_cc);
}
if (sb->sb_cc || sb->sb_mb || sb->sb_mbcnt)
panic("sbflush: cc %ld || mb %p || mbcnt %ld", sb->sb_cc, (void *)sb->sb_mb, sb->sb_mbcnt);
}