HomeFreeBSD

ng_l2tp: Fix callout synchronization in the rexmit timeout handler

Description

ng_l2tp: Fix callout synchronization in the rexmit timeout handler

A received control packet may cause the transmit queue to be flushed, in
which case ng_l2tp_seq_recv_nr() cancels the transmit timeout handler.
The handler checks to see if it was cancelled before doing anything, but
did so before acquiring the node lock, so a small race window could
cause ng_l2tp_seq_rack_timeout() to attempt to flush an empty queue,
ultimately causing a null pointer dereference.

PR: 241133
Reviewed by: bz, glebius, Lutz Donnerhacke
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC (Netgate)
Differential Revision: https://reviews.freebsd.org/D26548

Details

Provenance
markjAuthored on Sep 25 2020, 6:55 PM
Parents
rGf9f298a2f4e2: Comment out bogus command line entry
Branches
Unknown
Tags
Unknown