6818637 udp_tpi_connect can use stale pointer
authorRao Shoaib <Rao.Shoaib@Sun.COM>
Mon, 23 Mar 2009 10:52:17 -0700
changeset 9142 a124ed7aec81
parent 9141 d51ab4b3e040
child 9143 a1067ef02fc5
6818637 udp_tpi_connect can use stale pointer
usr/src/uts/common/inet/ip/icmp.c
usr/src/uts/common/inet/udp/udp.c
--- a/usr/src/uts/common/inet/ip/icmp.c	Mon Mar 23 10:33:46 2009 -0600
+++ b/usr/src/uts/common/inet/ip/icmp.c	Mon Mar 23 10:52:17 2009 -0700
@@ -668,7 +668,6 @@
 			    sizeof (sin6_t), NULL, 0);
 		}
 		if (mp1 == NULL) {
-			rw_exit(&icmp->icmp_rwlock);
 			icmp_err_ack(q, mp, TSYSERR, ENOMEM);
 			return;
 		}
@@ -679,7 +678,6 @@
 		mp = mi_tpi_ok_ack_alloc(mp);
 		if (mp == NULL) {
 			/* Unable to reuse the T_CONN_REQ for the ack. */
-			freemsg(mp1);
 			icmp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
 			return;
 		}
--- a/usr/src/uts/common/inet/udp/udp.c	Mon Mar 23 10:33:46 2009 -0600
+++ b/usr/src/uts/common/inet/udp/udp.c	Mon Mar 23 10:52:17 2009 -0700
@@ -696,7 +696,6 @@
 static void
 udp_tpi_connect(queue_t *q, mblk_t *mp)
 {
-	mblk_t	*mp1;
 	udp_t	*udp;
 	conn_t	*connp = Q_TO_CONN(q);
 	int	error;
@@ -762,44 +761,40 @@
 		return;
 	}
 
-	/*
-	 * We have to send a connection confirmation to
-	 * keep TLI happy.
-	 */
-	if (udp->udp_family == AF_INET) {
-		mp1 = mi_tpi_conn_con(NULL, (char *)sa,
-		    sizeof (sin_t), NULL, 0);
-	} else {
-		mp1 = mi_tpi_conn_con(NULL, (char *)sa,
-		    sizeof (sin6_t), NULL, 0);
-	}
-	if (mp1 == NULL) {
-		udp_err_ack(q, mp, TSYSERR, ENOMEM);
-		return;
-	}
-
-	/*
-	 * Allocate the largest primitive we need to send back
-	 * T_error_ack is > than T_ok_ack
-	 */
-	mp = reallocb(mp, sizeof (struct T_error_ack), 1);
-	if (mp == NULL) {
-		/* Unable to reuse the T_CONN_REQ for the ack. */
-		freemsg(mp1);
-		udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
-		return;
-	}
-
 	error = udp_do_connect(connp, sa, len, cr);
 	if (error != 0) {
-		freeb(mp1);
 		if (error < 0)
 			udp_err_ack(q, mp, -error, 0);
 		else
 			udp_err_ack(q, mp, TSYSERR, error);
 	} else {
+		mblk_t	*mp1;
+		/*
+		 * We have to send a connection confirmation to
+		 * keep TLI happy.
+		 */
+		if (udp->udp_family == AF_INET) {
+			mp1 = mi_tpi_conn_con(NULL, (char *)sa,
+			    sizeof (sin_t), NULL, 0);
+		} else {
+			mp1 = mi_tpi_conn_con(NULL, (char *)sa,
+			    sizeof (sin6_t), NULL, 0);
+		}
+		if (mp1 == NULL) {
+			udp_err_ack(q, mp, TSYSERR, ENOMEM);
+			return;
+		}
+
+		/*
+		 * Send ok_ack for T_CONN_REQ
+		 */
 		mp = mi_tpi_ok_ack_alloc(mp);
-		ASSERT(mp != NULL);
+		if (mp == NULL) {
+			/* Unable to reuse the T_CONN_REQ for the ack. */
+			udp_err_ack_prim(q, mp1, T_CONN_REQ, TSYSERR, ENOMEM);
+			return;
+		}
+
 		putnext(connp->conn_rq, mp);
 		putnext(connp->conn_rq, mp1);
 	}