diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-01-13 23:20:46 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-01-13 23:20:46 +0000 |
| commit | ceba9a0086d69c997a39411b5fbd5bf1c0204b08 (patch) | |
| tree | 9d4faa09f5498fa2f0b285a70eeecc0db6cc7ff1 /sys/net/if_ef.c | |
| parent | a062d55bf0396901903aba3865321f0bd71be46e (diff) | |
| download | FreeBSD-src-ceba9a0086d69c997a39411b5fbd5bf1c0204b08.zip FreeBSD-src-ceba9a0086d69c997a39411b5fbd5bf1c0204b08.tar.gz | |
When freeing the chain of if_ef devices on an aborted load, use
SLIST_FOREACH_SAFE() rather than SLIST_FOREACH(), as elements are
freed on each iteration of the loop. This prevents use-after-free.
Noticed by: Coverity Prevent analysis tool
MFC after: 3 days
Diffstat (limited to 'sys/net/if_ef.c')
| -rw-r--r-- | sys/net/if_ef.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/if_ef.c b/sys/net/if_ef.c index 849c8db..2c2828c 100644 --- a/sys/net/if_ef.c +++ b/sys/net/if_ef.c @@ -491,7 +491,7 @@ ef_load(void) { struct ifnet *ifp; struct efnet *efp; - struct ef_link *efl = NULL; + struct ef_link *efl = NULL, *efl_temp; int error = 0, d; IFNET_RLOCK(); @@ -529,7 +529,7 @@ ef_load(void) if (error) { if (efl) SLIST_INSERT_HEAD(&efdev, efl, el_next); - SLIST_FOREACH(efl, &efdev, el_next) { + SLIST_FOREACH_SAFE(efl, &efdev, el_next, efl_temp) { for (d = 0; d < EF_NFT; d++) if (efl->el_units[d]) { if (efl->el_units[d]->ef_pifp != NULL) |
