Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F105785221
D19622.id55190.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Flag For Later
Award Token
Size
1 KB
Referenced Files
None
Subscribers
None
D19622.id55190.diff
View Options
Index: sys/kern/kern_mbuf.c
===================================================================
--- sys/kern/kern_mbuf.c
+++ sys/kern/kern_mbuf.c
@@ -813,6 +813,13 @@
(*pr->pr_drain)();
}
+void
+mb_reclaim_from_all_domains(void)
+{
+
+ mb_reclaim(NULL, 0);
+}
+
/*
* Clean up after mbufs with M_EXT storage attached to them if the
* reference count hits 1.
Index: sys/net/if.c
===================================================================
--- sys/net/if.c
+++ sys/net/if.c
@@ -1206,6 +1206,13 @@
finish_vnet_shutdown:
#endif
/*
+ * Make sure all re-assembly mbufs get freed. This prevents
+ * references to our network interface structure after detach
+ * through mb->rcvif .
+ */
+ mb_reclaim_from_all_domains();
+
+ /*
* We cannot hold the lock over dom_ifdetach calls as they might
* sleep, for example trying to drain a callout, thus open up the
* theoretical race with re-attaching.
Index: sys/sys/mbuf.h
===================================================================
--- sys/sys/mbuf.h
+++ sys/sys/mbuf.h
@@ -615,6 +615,7 @@
void mb_dupcl(struct mbuf *, struct mbuf *);
void mb_free_ext(struct mbuf *);
+void mb_reclaim_from_all_domains(void);
void m_adj(struct mbuf *, int);
int m_apply(struct mbuf *, int, int,
int (*)(void *, void *, u_int), void *);
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Sat, Dec 21, 4:17 PM (16 h, 20 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
15543054
Default Alt Text
D19622.id55190.diff (1 KB)
Attached To
Mode
D19622: Fix panic in network stack due memory use after free in relation to fragmented packets
Attached
Detach File
Event Timeline
Log In to Comment