diff options
author | thompsa <thompsa@FreeBSD.org> | 2005-10-12 19:52:16 +0000 |
---|---|---|
committer | thompsa <thompsa@FreeBSD.org> | 2005-10-12 19:52:16 +0000 |
commit | d6130a47038460d2093bdc0fcdadd546393cc823 (patch) | |
tree | e685414c2d4a9a0e96a99f9d18fa6ce3780a6fbe /sys/contrib/pf/net | |
parent | 1917bf7b66cadbb6cbcc022f50fb4252b6996ff7 (diff) | |
download | FreeBSD-src-d6130a47038460d2093bdc0fcdadd546393cc823.zip FreeBSD-src-d6130a47038460d2093bdc0fcdadd546393cc823.tar.gz |
Change the reference counting to count the number of cloned interfaces for each
cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.
Assert that all cloners have been destroyed when freeing the memory.
Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.
Discussed with: brooks, pjd, -current
Reviewed by: brooks
Diffstat (limited to 'sys/contrib/pf/net')
-rw-r--r-- | sys/contrib/pf/net/if_pflog.c | 3 | ||||
-rw-r--r-- | sys/contrib/pf/net/if_pfsync.c | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/sys/contrib/pf/net/if_pflog.c b/sys/contrib/pf/net/if_pflog.c index 1fd6a82..2497a94 100644 --- a/sys/contrib/pf/net/if_pflog.c +++ b/sys/contrib/pf/net/if_pflog.c @@ -370,7 +370,8 @@ pflog_modevent(module_t mod, int type, void *data) case MOD_UNLOAD: if_clone_detach(&pflog_cloner); while (!LIST_EMPTY(&pflog_list)) - pflog_clone_destroy(SCP2IFP(LIST_FIRST(&pflog_list))); + ifc_simple_destroy(&pflog_cloner, + SCP2IFP(LIST_FIRST(&pflog_list))); break; default: diff --git a/sys/contrib/pf/net/if_pfsync.c b/sys/contrib/pf/net/if_pfsync.c index 971eea7..5f0e8a6 100644 --- a/sys/contrib/pf/net/if_pfsync.c +++ b/sys/contrib/pf/net/if_pfsync.c @@ -1852,7 +1852,7 @@ pfsync_modevent(module_t mod, int type, void *data) case MOD_UNLOAD: if_clone_detach(&pfsync_cloner); while (!LIST_EMPTY(&pfsync_list)) - pfsync_clone_destroy( + ifc_simple_destroy(&pfsync_cloner, SCP2IFP(LIST_FIRST(&pfsync_list))); break; |