o5r/plan9port
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

correct dangling pointer race (Bakul Shah)

Browse source
This commit is contained in:
rsc 2007-04-08 01:30:26 +00:00
parent 8ecb4ffe4c
commit 4f6d2bb1e8
4 changed files with 36 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/libventi/send.c
View file

@ -147,7 +147,7 @@ vtrecvproc(void *v)
_vtqhangup(q);
while((p = _vtnbqrecv(q)) != nil)
packetfree(p);
_vtqfree(q);
_vtqdecref(q);
z->readq = nil;
rwakeup(&z->rpcfork);
qunlock(&z->lk);
@ -178,7 +178,7 @@ vtsendproc(void *v)
_vtqhangup(q);
while((p = _vtnbqrecv(q)) != nil)
packetfree(p);
_vtqfree(q);
_vtqdecref(q);
z->writeq = nil;
rwakeup(&z->rpcfork);
qunlock(&z->lk);
@ -189,6 +189,7 @@ Packet*
vtrecv(VtConn *z)
{
Packet *p;
Queue *q;
qlock(&z->lk);
if(z->state != VtStateConnected){
@ -197,8 +198,11 @@ vtrecv(VtConn *z)
return nil;
}
if(z->readq){
q = _vtqincref(z->readq);
qunlock(&z->lk);
return _vtqrecv(z->readq);
p = _vtqrecv(q);
_vtqdecref(q);
return p;
}
qlock(&z->inlk);
@ -213,6 +217,8 @@ vtrecv(VtConn *z)
int
vtsend(VtConn *z, Packet *p)
{
Queue *q;
qlock(&z->lk);
if(z->state != VtStateConnected){
packetfree(p);
@ -221,11 +227,14 @@ vtsend(VtConn *z, Packet *p)
return -1;
}
if(z->writeq){
q = _vtqincref(z->writeq);
qunlock(&z->lk);
if(_vtqsend(z->writeq, p) < 0){
if(_vtqsend(q, p) < 0){
_vtqdecref(q);
packetfree(p);
return -1;
}
_vtqdecref(q);
return 0;
}