Date: Sat, 26 Jan 2019 15:29:37 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 235097] ci runs panic with use-after-free when running sys/netpfil/pf/nat tests Message-ID: <bug-235097-7501-QJYFRL6Yp2@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=235097 --- Comment #16 from Kristof Provost <kp@freebsd.org> --- (In reply to Andrey V. Elsukov from comment #14) > ifa_free() does not free the memory immediately, so it is safe to make access to ifp->if_addr while you are in NET_EPOCH() section. Right, but if ifa_free() queues the release to happen after everyone who might be using it has left the NET_EPOCH() section we can still have the pointer to a freed structure around if we don't NULL out the if_addr pointer. The problem is that there are two pointers to the struct ifaddr. We remove one (from the if_addrhead list), but keep the other one around. -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-235097-7501-QJYFRL6Yp2>