Page MenuHomeFreeBSD

udp: Fix a refcount leak in the tunnel receive path
ClosedPublic

Authored by markj on Fri, Jul 25, 2:27 AM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Aug 10, 9:16 AM
Unknown Object (File)
Sun, Aug 3, 3:21 AM
Unknown Object (File)
Fri, Aug 1, 9:17 PM
Unknown Object (File)
Thu, Jul 31, 1:07 AM
Unknown Object (File)
Tue, Jul 29, 11:53 AM
Unknown Object (File)
Tue, Jul 29, 5:45 AM
Unknown Object (File)
Tue, Jul 29, 4:52 AM
Unknown Object (File)
Tue, Jul 29, 4:23 AM

Details

Summary

When the socket has a tunneling function attached, udp_append() drops
the inpcb lock before calling it. To keep the inpcb live, we take a
reference. After commit 742e7210d00b we only dropped the reference if
the tunnel consumed the packet, but we need to drop it in either case.

Fixes: 742e7210d00b ("udp: allow udp_tun_func_t() to indicate it did not eat the packet")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65678
Build 62561: arc lint + arc unit