path: root/sys/sys/unpcb.h
diff options
authorConrad Meyer <cem@FreeBSD.org>2015-07-14 02:00:50 +0000
committerConrad Meyer <cem@FreeBSD.org>2015-07-14 02:00:50 +0000
commit0c40f3532d947d138d5a99f5c8853de06de44fec (patch)
tree739399a2fae275099b377fb3967997e0a672d3b6 /sys/sys/unpcb.h
parent36632bef0c467d17779905778aa6afc51ec9e9a4 (diff)
Fix cleanup race between unp_dispose and unp_gc
unp_dispose and unp_gc could race to teardown the same mbuf chains, which can lead to dereferencing freed filedesc pointers. This patch adds an IGNORE_RIGHTS flag on unpcbs marking the unpcb's RIGHTS as invalid/freed. The flag is protected by UNP_LIST_LOCK. To serialize against unp_gc, unp_dispose needs the socket object. Change the dom_dispose() KPI to take a socket object instead of an mbuf chain directly. PR: 194264 Differential Revision: https://reviews.freebsd.org/D3044 Reviewed by: mjg (earlier version) Approved by: markj (mentor) Obtained from: mjg MFC after: 1 month Sponsored by: EMC / Isilon Storage Division
Notes: svn path=/head/; revision=285522
Diffstat (limited to 'sys/sys/unpcb.h')
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/sys/unpcb.h b/sys/sys/unpcb.h
index ba63f3044374..41fd5745bbd7 100644
--- a/sys/sys/unpcb.h
+++ b/sys/sys/unpcb.h
@@ -106,6 +106,7 @@ struct unpcb {
#define UNPGC_REF 0x1 /* unpcb has external ref. */
#define UNPGC_DEAD 0x2 /* unpcb might be dead. */
#define UNPGC_SCANNED 0x4 /* Has been scanned. */
+#define UNPGC_IGNORE_RIGHTS 0x8 /* Attached rights are freed */
* These flags are used to handle non-atomicity in connect() and bind()