Fix two cases of incorrect IPQ_UNLOCK'ing in the merged ip_reass() function.
The first one was going to 'dropfrag', which unlocks the IPQ, before the lock was aquired; The second one doing a unlock and then a 'goto dropfrag' which led to a double-unlock. Tripped over by: des
This commit is contained in:
parent
a71e43e2c6
commit
6822e5677f
@ -895,7 +895,8 @@ ip_reass(struct mbuf *m)
|
||||
if (maxnipq == 0) {
|
||||
ipstat.ips_fragments++;
|
||||
ipstat.ips_fragdropped++;
|
||||
goto dropfrag;
|
||||
m_freem(m);
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
ip = mtod(m, struct ip *);
|
||||
@ -959,7 +960,6 @@ ip_reass(struct mbuf *m)
|
||||
* that's a non-zero multiple of 8 bytes.
|
||||
*/
|
||||
if (ip->ip_len == 0 || (ip->ip_len & 0x7) != 0) {
|
||||
IPQ_UNLOCK();
|
||||
ipstat.ips_toosmall++; /* XXX */
|
||||
goto dropfrag;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user