>Number:         24782
>Category:       kern
>Synopsis:       pool corruption in tcp/ip reassembly
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Mar 15 00:17:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
>Release:        NetBSD 1.6ZK
>Organization:

>Environment:
	
	
System: NetBSD kaeru 1.6ZK NetBSD 1.6ZK (build.kaeru) #1088: Sun Mar 14 17:05:34 JST 2004 takashi@kaeru:/usr/home/takashi/work/kernel/build.kaeru i386
Architecture: i386
Machine: i386
>Description:
	while ip_reass() is putting an item to ipqent_pool,
	an interrupt can happen and it might do tcp_drain() and touch
	the same pool.
>How-To-Repeat:
>Fix:
	protect ipqent_pool with splnet?
	
>Release-Note:
>Audit-Trail:
>Unformatted: