Mark Johnston
e62e4b8594
ng_l2tp: Fix callout synchronization in the rexmit timeout handler ...
A received control packet may cause the transmit queue to be flushed, in
which case ng_l2tp_seq_recv_nr() cancels the transmit timeout handler.
The handler checks to see if it was cancelled before doing anything, but
did so before acquiring the node lock, so a small race window could
cause ng_l2tp_seq_rack_timeout() to attempt to flush an empty queue,
ultimately causing a null pointer dereference.
PR: 241133
Reviewed by: bz, glebius, Lutz Donnerhacke
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC (Netgate)
Differential Revision: https://reviews.freebsd.org/D26548
2020-09-25 18:55:50 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-03-04 22:32:40 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-02 11:49:22 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-07-31 14:08:54 +00:00
2019-10-07 22:40:05 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-25 18:55:50 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2018-12-17 16:00:35 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-08-18 22:46:46 +00:00
2020-09-01 21:19:14 +00:00
2020-09-02 11:49:22 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2018-11-04 19:10:44 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2018-11-27 04:05:38 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
2020-09-01 21:19:14 +00:00
e62e4b8594