fix bug that can cause recursive .forward files to fail

[unix-history] / usr / src / sys / kern / uipc_usrreq.c

diff --git a/usr/src/sys/kern/uipc_usrreq.c b/usr/src/sys/kern/uipc_usrreq.c
index f44b3b9..04b723b 100644 (file)
--- a/usr/src/sys/kern/uipc_usrreq.c
+++ b/usr/src/sys/kern/uipc_usrreq.c
@@ -2,7 +2,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)uipc_usrreq.c       7.39 (Berkeley) %G%
+ *     @(#)uipc_usrreq.c       8.2 (Berkeley) %G%

  */
 
 #include <sys/param.h>
  */
 
 #include <sys/param.h>


@@ -335,8 +335,17 @@ unp_detach(unp)
        unp->unp_socket->so_pcb = 0;
        m_freem(unp->unp_addr);
        (void) m_free(dtom(unp));
        unp->unp_socket->so_pcb = 0;
        m_freem(unp->unp_addr);
        (void) m_free(dtom(unp));

-       if (unp_rights)
+       if (unp_rights) {
+               /*
+                * Normally the receive buffer is flushed later,
+                * in sofree, but if our receive buffer holds references
+                * to descriptors that are now garbage, we will dispose
+                * of those descriptor references after the garbage collector
+                * gets them (resulting in a "panic: closef: count < 0").
+                */
+               sorflush(unp->unp_socket);

                unp_gc();
                unp_gc();

+       }

 }
 
 unp_bind(unp, nam, p)
 }
 
 unp_bind(unp, nam, p)


@@ -374,7 +383,7 @@ unp_bind(unp, nam, p)
        }
        VATTR_NULL(&vattr);
        vattr.va_type = VSOCK;
        }
        VATTR_NULL(&vattr);
        vattr.va_type = VSOCK;

-       vattr.va_mode = 0777;
+       vattr.va_mode = ACCESSPERMS;

        LEASE_CHECK(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
        if (error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr))
                return (error);
        LEASE_CHECK(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
        if (error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr))
                return (error);


@@ -781,8 +790,6 @@ unp_discard(fp)
        struct file *fp;
 {
 
        struct file *fp;
 {
 

-       if (fp->f_msgcount == 0)
-               return;

        fp->f_msgcount--;
        unp_rights--;
        (void) closef(fp, (struct proc *)NULL);
        fp->f_msgcount--;
        unp_rights--;
        (void) closef(fp, (struct proc *)NULL);