From 30b7addf5acdb9f73a38ea014ff1533c4cce91ff Mon Sep 17 00:00:00 2001 From: Gleb Smirnoff Date: Thu, 3 Oct 2019 02:34:51 +0000 Subject: [PATCH] Protect access to seq->xwin[] with the seq mutex. MFC after: 5 weeks --- sys/netgraph/ng_l2tp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sys/netgraph/ng_l2tp.c b/sys/netgraph/ng_l2tp.c index 55fa2cd31060..91d998965d88 100644 --- a/sys/netgraph/ng_l2tp.c +++ b/sys/netgraph/ng_l2tp.c @@ -1462,6 +1462,7 @@ ng_l2tp_seq_rack_timeout(node_p node, hook_p hook, void *arg1, int arg2) /* Sanity check */ L2TP_SEQ_CHECK(seq); + mtx_lock(&seq->mtx); priv->stats.xmitRetransmits++; /* Have we reached the retransmit limit? If so, notify owner. */ @@ -1482,7 +1483,9 @@ ng_l2tp_seq_rack_timeout(node_p node, hook_p hook, void *arg1, int arg2) seq->acks = 0; /* Retransmit oldest unack'd packet */ - if ((m = L2TP_COPY_MBUF(seq->xwin[0], M_NOWAIT)) == NULL) + m = L2TP_COPY_MBUF(seq->xwin[0], M_NOWAIT); + mtx_unlock(&seq->mtx); + if (m == NULL) priv->stats.memoryFailures++; else ng_l2tp_xmit_ctrl(priv, m, seq->ns++);