From owner-cvs-src-old@FreeBSD.ORG  Tue Oct 20 21:37:14 2009
Return-Path: <owner-cvs-src-old@FreeBSD.ORG>
Delivered-To: cvs-src-old@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7825410656C4
	for <cvs-src-old@freebsd.org>; Tue, 20 Oct 2009 21:37:14 +0000 (UTC)
	(envelope-from qingli@FreeBSD.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id 66B018FC21
	for <cvs-src-old@freebsd.org>; Tue, 20 Oct 2009 21:37:14 +0000 (UTC)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id n9KLbEfl016830
	for <cvs-src-old@freebsd.org>; Tue, 20 Oct 2009 21:37:14 GMT
	(envelope-from qingli@repoman.freebsd.org)
Received: (from svn2cvs@localhost)
	by repoman.freebsd.org (8.14.3/8.14.3/Submit) id n9KLbEWq016829
	for cvs-src-old@freebsd.org; Tue, 20 Oct 2009 21:37:14 GMT
	(envelope-from qingli@repoman.freebsd.org)
Message-Id: <200910202137.n9KLbEWq016829@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: svn2cvs set sender to
	qingli@repoman.freebsd.org using -f
From: Qing Li <qingli@FreeBSD.org>
Date: Tue, 20 Oct 2009 21:36:56 +0000 (UTC)
To: cvs-src-old@freebsd.org
X-FreeBSD-CVS-Branch: RELENG_8
Subject: cvs commit: src/sys/netinet if_ether.c
X-BeenThere: cvs-src-old@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: **OBSOLETE** CVS commit messages for the src tree
	<cvs-src-old.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src-old>,
	<mailto:cvs-src-old-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/cvs-src-old>
List-Post: <mailto:cvs-src-old@freebsd.org>
List-Help: <mailto:cvs-src-old-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/cvs-src-old>,
	<mailto:cvs-src-old-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Oct 2009 21:37:14 -0000

qingli      2009-10-20 21:36:56 UTC

  FreeBSD src repository

  Modified files:        (Branch: RELENG_8)
    sys/netinet          if_ether.c 
  Log:
  SVN rev 198308 on 2009-10-20 21:36:56Z by qingli
  
  MFC     198301
  
  In the ARP callout timer expiration function, the current time_second
  is compared against the entry expiration time value (that was set based
  on time_second) to check if the current time is larger than the set
  expiration time. Due to the +/- timer granularity value, the comparison
  returns false, causing the alternative code to be executed. The
  alternative code path freed the memory without removing that entry
  from the table list, causing a use-after-free bug.
  
  Reviewed by:    discussed with kmacy
  Approved by:    re
  Verified by:    rnoland, yongari
  
  Revision   Changes    Path
  1.208.2.5  +9 -9      src/sys/netinet/if_ether.c