git: 9c67d6ed9632 - main - inpcb: inp_next() never returns a freed inpcb
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 22 Oct 2026 03:31:29 UTC
The branch main has been updated by glebius:
URL: https://cgit.FreeBSD.org/src/commit/?id=9c67d6ed9632e180e95bebabc5a8ceae7f22ce1a
commit 9c67d6ed9632e180e95bebabc5a8ceae7f22ce1a
Author: Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2026-10-21 21:36:01 +0000
Commit: Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2026-10-22 03:29:46 +0000
inpcb: inp_next() never returns a freed inpcb
---
sys/netinet6/in6_pcb.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 6e30ec15faff..05c04be5dd80 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -733,13 +733,11 @@ in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr_in6 *sa6_dst,
* as usual.
*/
if (lport == 0 && fport == 0 && flowinfo &&
- inp->inp_socket != NULL &&
flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
goto do_notify;
else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
&sa6_dst->sin6_addr) ||
- inp->inp_socket == 0 ||
(lport && inp->inp_lport != lport) ||
(!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
!IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,