Date: Sat, 26 Jan 2019 15:29:37 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 235097] ci runs panic with use-after-free when running sys/netpfil/pf/nat tests Message-ID: <bug-235097-7501-QJYFRL6Yp2@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-235097-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D235097 --- Comment #16 from Kristof Provost <kp@freebsd.org> --- (In reply to Andrey V. Elsukov from comment #14) > ifa_free() does not free the memory immediately, so it is safe to make ac= cess to ifp->if_addr while you are in NET_EPOCH() section. Right, but if ifa_free() queues the release to happen after everyone who mi= ght be using it has left the NET_EPOCH() section we can still have the pointer = to a freed structure around if we don't NULL out the if_addr pointer. The problem is that there are two pointers to the struct ifaddr. We remove = one (from the if_addrhead list), but keep the other one around. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-235097-7501-QJYFRL6Yp2>