Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sys_accept: fix usecount botch and double soclose in rev.1.108.

Browse Source
This commit is contained in:
yamt 2007-04-18 10:20:02 +00:00
parent 50742758a1
commit 2c410c0431
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sys/kern/uipc_syscalls.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: uipc_syscalls.c,v 1.108 2007/04/15 05:25:02 yamt Exp $ */ /* $NetBSD: uipc_syscalls.c,v 1.109 2007/04/18 10:20:02 yamt Exp $ */
/* /*
* Copyright (c) 1982, 1986, 1989, 1990, 1993 * Copyright (c) 1982, 1986, 1989, 1990, 1993
@ -32,7 +32,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.108 2007/04/15 05:25:02 yamt Exp $"); __KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.109 2007/04/18 10:20:02 yamt Exp $");
#include "opt_ktrace.h" #include "opt_ktrace.h"
#include "opt_pipe.h" #include "opt_pipe.h"
@ -232,18 +232,15 @@ sys_accept(struct lwp *l, void *v, register_t *retval)
fp->f_flag = fflag; fp->f_flag = fflag;
fp->f_ops = &socketops; fp->f_ops = &socketops;
fp->f_data = (void *)so; fp->f_data = (void *)so;
FILE_UNUSE(fp, l);
nam = m_get(M_WAIT, MT_SONAME); nam = m_get(M_WAIT, MT_SONAME);
if ((error = soaccept(so, nam)) == 0 && SCARG(uap, name)) { if ((error = soaccept(so, nam)) == 0 && SCARG(uap, name)) {
if (namelen > nam->m_len) if (namelen > nam->m_len)
namelen = nam->m_len; namelen = nam->m_len;
/* SHOULD COPY OUT A CHAIN HERE */ /* SHOULD COPY OUT A CHAIN HERE */
if ((error = copyout(mtod(nam, void *), error = copyout(mtod(nam, void *), SCARG(uap, name), namelen);
(void *)SCARG(uap, name), namelen)) != 0 || if (error == 0) {
(error = copyout((void *)&namelen, error = copyout(&namelen, SCARG(uap, anamelen),
(void *)SCARG(uap, anamelen), sizeof(*SCARG(uap, anamelen)));
sizeof(*SCARG(uap, anamelen)))) != 0) {
soclose(so);
} }
} }
/* if an error occurred, free the file descriptor */ /* if an error occurred, free the file descriptor */
@ -252,6 +249,7 @@ sys_accept(struct lwp *l, void *v, register_t *retval)
closef(fp, l); closef(fp, l);
} else { } else {
FILE_SET_MATURE(fp); FILE_SET_MATURE(fp);
FILE_UNUSE(fp, l);
} }
m_freem(nam); m_freem(nam);
splx(s); splx(s);