diff options
| author | kmacy <kmacy@FreeBSD.org> | 2012-02-23 18:21:37 +0000 |
|---|---|---|
| committer | kmacy <kmacy@FreeBSD.org> | 2012-02-23 18:21:37 +0000 |
| commit | a99e9d281db6624cf9b88f07759a77f7b2d96a33 (patch) | |
| tree | 3a2da57fb6f6af971e7fb849770dc0f9b231bca2 /sys/net | |
| parent | ffbbf1cb2c6c124090347c8c43c4eefb65ae1bd5 (diff) | |
| download | FreeBSD-src-a99e9d281db6624cf9b88f07759a77f7b2d96a33.zip FreeBSD-src-a99e9d281db6624cf9b88f07759a77f7b2d96a33.tar.gz | |
When using flowtable llentrys can outlive the interface with which they're associated
at which the lle_tbl pointer points to freed memory and the llt_free pointer is no longer
valid.
Move the free pointer in to the llentry itself and update the initalization sites.
MFC after: 2 weeks
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/if_llatbl.h | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/net/if_llatbl.h b/sys/net/if_llatbl.h index 2ae2792..e90b29c 100644 --- a/sys/net/if_llatbl.h +++ b/sys/net/if_llatbl.h @@ -106,7 +106,6 @@ struct llentry { ("negative refcnt %d", (lle)->lle_refcnt)); \ (lle)->lle_refcnt++; \ } while (0) - #define LLE_REMREF(lle) do { \ LLE_WLOCK_ASSERT(lle); \ KASSERT((lle)->lle_refcnt > 1, \ @@ -116,7 +115,7 @@ struct llentry { #define LLE_FREE_LOCKED(lle) do { \ if ((lle)->lle_refcnt <= 1) \ - (lle)->lle_tbl->llt_free((lle)->lle_tbl, (lle));\ + (lle)->lle_free((lle)->lle_tbl, (lle));\ else { \ (lle)->lle_refcnt--; \ LLE_WUNLOCK(lle); \ @@ -152,7 +151,6 @@ struct lltable { int llt_af; struct ifnet *llt_ifp; - void (*llt_free)(struct lltable *, struct llentry *); void (*llt_prefix_free)(struct lltable *, const struct sockaddr *prefix, const struct sockaddr *mask, |
