svn commit: r191476 - head/sys/netinet

[Robert Watson]

Author: rwatson
Date: Fri Apr 24 22:11:53 2009
New Revision: 191476
URL: http://svn.freebsd.org/changeset/base/191476

Log:
  In in_purgemaddrs(), remove the inm being freed from the address list
  before freeing it, rather than vice version, to avoid potential use
  after free.
  
  Reviewed by:	bms

Modified:
  head/sys/netinet/in.c

Modified: head/sys/netinet/in.c
==============================================================================
--- head/sys/netinet/in.c	Fri Apr 24 19:05:22 2009	(r191475)
+++ head/sys/netinet/in.c	Fri Apr 24 22:11:53 2009	(r191476)
@@ -1079,8 +1079,8 @@ in_purgemaddrs(struct ifnet *ifp)
 	IF_ADDR_UNLOCK(ifp);
 
 	LIST_FOREACH_SAFE(inm, &purgeinms, inm_link, tinm) {
-		inm_release_locked(inm);
 		LIST_REMOVE(inm, inm_link);
+		inm_release_locked(inm);
 	}
 	igmp_ifdetach(ifp);