CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2011/03/12 11:31:41
Modified files:
sys/kern : uipc_socket.c
share/man/man9 : sosplice.9
Log message:
There existed a race when a process was trying to read from a spliced
socket. soreceive() releases splsoftnet for uiomove(). In that
moment, somove() could pull the mbuf from the receive buffer. After
that, soreceive removed the mbuf again. The corrupted length
accounting resulted in a panic.
The fix is to block read calls in soreceive() until splicing has
been finished.
just commit deraadt@
