svn commit: r191476 - head/sys/netinet
Robert Watson
rwatson at FreeBSD.org
Fri Apr 24 22:11:54 UTC 2009
Author: rwatson
Date: Fri Apr 24 22:11:53 2009
New Revision: 191476
URL: http://svn.freebsd.org/changeset/base/191476
Log:
In in_purgemaddrs(), remove the inm being freed from the address list
before freeing it, rather than vice version, to avoid potential use
after free.
Reviewed by: bms
Modified:
head/sys/netinet/in.c
Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c Fri Apr 24 19:05:22 2009 (r191475)
+++ head/sys/netinet/in.c Fri Apr 24 22:11:53 2009 (r191476)
@@ -1079,8 +1079,8 @@ in_purgemaddrs(struct ifnet *ifp)
IF_ADDR_UNLOCK(ifp);
LIST_FOREACH_SAFE(inm, &purgeinms, inm_link, tinm) {
- inm_release_locked(inm);
LIST_REMOVE(inm, inm_link);
+ inm_release_locked(inm);
}
igmp_ifdetach(ifp);
More information about the svn-src-all
mailing list