diff options
| author | rwatson <rwatson@FreeBSD.org> | 2009-04-24 22:11:53 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2009-04-24 22:11:53 +0000 |
| commit | 98b615af7174eb4ed9af281c73c8c7b437060134 (patch) | |
| tree | 460718d2321cf927019281e29bee92386d612b28 /sys/netinet/in.c | |
| parent | bfd5362e9617fb6928d68fedf776dd6396ee8acd (diff) | |
| download | FreeBSD-src-98b615af7174eb4ed9af281c73c8c7b437060134.zip FreeBSD-src-98b615af7174eb4ed9af281c73c8c7b437060134.tar.gz | |
In in_purgemaddrs(), remove the inm being freed from the address list
before freeing it, rather than vice version, to avoid potential use
after free.
Reviewed by: bms
Diffstat (limited to 'sys/netinet/in.c')
| -rw-r--r-- | sys/netinet/in.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/in.c b/sys/netinet/in.c index 8d5f946..a378c10 100644 --- a/sys/netinet/in.c +++ b/sys/netinet/in.c @@ -1079,8 +1079,8 @@ in_purgemaddrs(struct ifnet *ifp) IF_ADDR_UNLOCK(ifp); LIST_FOREACH_SAFE(inm, &purgeinms, inm_link, tinm) { - inm_release_locked(inm); LIST_REMOVE(inm, inm_link); + inm_release_locked(inm); } igmp_ifdetach(ifp); |
