The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=d00c20882f88877884b73fa9ec86b3cafeda4e42
commit d00c20882f88877884b73fa9ec86b3cafeda4e42 Author: John Baldwin <[email protected]> AuthorDate: 2022-11-30 22:38:51 +0000 Commit: John Baldwin <[email protected]> CommitDate: 2022-11-30 22:38:51 +0000 udp[6]_multi_input: Don't unlock freed inp. If udp[6]_append() returns non-zero, it is because the inp has gone away (inpcbrele_rlocked returned 1 after running the tunnel function). Reviewed by: ae Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D37511 --- sys/netinet/udp_usrreq.c | 1 - sys/netinet6/udp6_usrreq.c | 1 - 2 files changed, 2 deletions(-) diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 8e8547a42922..719b39985a0f 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -446,7 +446,6 @@ udp_multi_input(struct mbuf *m, int proto, struct sockaddr_in *udp_in) else UDP_PROBE(receive, NULL, inp, ip, inp, uh); if (udp_append(inp, ip, n, sizeof(struct ip), udp_in)) { - INP_RUNLOCK(inp); break; } else appends++; diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index b6390f800d98..b491a41a7a4b 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -312,7 +312,6 @@ udp6_multi_input(struct mbuf *m, int off, int proto, UDP_PROBE(receive, NULL, inp, ctx.ip6, inp, ctx.uh); if (udp6_append(inp, n, off, fromsa)) { - INP_RUNLOCK(inp); break; } else appends++;
