Date: Fri, 24 Apr 2009 22:11:53 +0000 (UTC) From: Robert Watson <rwatson@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r191476 - head/sys/netinet Message-ID: <200904242211.n3OMBrWP033454@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rwatson Date: Fri Apr 24 22:11:53 2009 New Revision: 191476 URL: http://svn.freebsd.org/changeset/base/191476 Log: In in_purgemaddrs(), remove the inm being freed from the address list before freeing it, rather than vice version, to avoid potential use after free. Reviewed by: bms Modified: head/sys/netinet/in.c Modified: head/sys/netinet/in.c ============================================================================== --- head/sys/netinet/in.c Fri Apr 24 19:05:22 2009 (r191475) +++ head/sys/netinet/in.c Fri Apr 24 22:11:53 2009 (r191476) @@ -1079,8 +1079,8 @@ in_purgemaddrs(struct ifnet *ifp) IF_ADDR_UNLOCK(ifp); LIST_FOREACH_SAFE(inm, &purgeinms, inm_link, tinm) { - inm_release_locked(inm); LIST_REMOVE(inm, inm_link); + inm_release_locked(inm); } igmp_ifdetach(ifp);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200904242211.n3OMBrWP033454>