svn commit: r280236 - head/sys/netinet6

[Andrey V. Elsukov]

Author: ae
Date: Thu Mar 19 00:04:25 2015
New Revision: 280236
URL: https://svnweb.freebsd.org/changeset/base/280236

Log:
  To avoid a possible race, release the reference to ifa after return
  from nd6_dad_na_input().
  
  Submitted by:	Alexandre Martins
  MFC after:	1 week

Modified:
  head/sys/netinet6/nd6_nbr.c

Modified: head/sys/netinet6/nd6_nbr.c
==============================================================================
--- head/sys/netinet6/nd6_nbr.c	Wed Mar 18 23:47:30 2015	(r280235)
+++ head/sys/netinet6/nd6_nbr.c	Thu Mar 19 00:04:25 2015	(r280236)
@@ -747,8 +747,8 @@ nd6_na_input(struct mbuf *m, int off, in
 	 */
 	if (ifa
 	 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
-		ifa_free(ifa);
 		nd6_dad_na_input(ifa);
+		ifa_free(ifa);
 		goto freeit;
 	}