DragonFlyBSD Kernel Audit
DF-0018 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/kern_dmsg.c b/sys/kern/kern_dmsg.c
--- a/sys/kern/kern_dmsg.c
+++ b/sys/kern/kern_dmsg.c
@@ -952,6 +952,20 @@
 			}
 			break;
 		}
+
+		/*
+		 * A duplicate DELETE can race our reply transmission (the
+		 * writer has not yet transmitted our REPLY|DELETE, so the
+		 * state is still in staterd_tree with rxcmd already carrying
+		 * DMSGF_DELETE).  Discard it benignly instead of tripping the
+		 * KKASSERT below (kern_dmsg.c:1076).
+		 */
+		if (state->rxcmd & DMSGF_DELETE) {
+			kdio_printf(iocom, 1, "%s\n",
+				    "msgrx: duplicate DELETE");
+			error = EALREADY;
+			break;
+		}
 		error = 0;
 		break;
 	default: