mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-01 12:19:28 +00:00
Code Issues Releases Activity

- Move IF_ADDR_LOCK_DESTROY(ifp) from if_free to if_free_type.

Browse Source 
- Add a note that additions should be made to if_free_type and not
  if_free to help avoid this in the future.

This apparently fixes a use after free in if_bridge and may fix bugs
in other direct if_free_type consumers.

Reported by:	thompsa
This commit is contained in:
Brooks Davis 2005-08-16 17:02:35 +00:00
parent 664a97517f
commit 7cf30146f0
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=149141
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/net/if.c
View File

@ -417,7 +417,7 @@ void
if_free(struct ifnet *ifp)
{
IF_ADDR_LOCK_DESTROY(ifp);
/* Do not add code to this function! Add it to if_free_type(). */
if_free_type(ifp, ifp->if_type);
}
@ -431,6 +431,8 @@ if_free_type(struct ifnet *ifp, u_char type)
return;
}
IF_ADDR_LOCK_DESTROY(ifp);
ifnet_byindex(ifp->if_index) = NULL;
/* XXX: should be locked with if_findindex() */