diff options
| author | kmacy <kmacy@FreeBSD.org> | 2008-12-16 00:16:51 +0000 |
|---|---|---|
| committer | kmacy <kmacy@FreeBSD.org> | 2008-12-16 00:16:51 +0000 |
| commit | 8cc0e3cda93eb82fdcd32bc3b75c038a171896c9 (patch) | |
| tree | 3400ed64dc10a7c0b30c2d580f433992c9faefa4 /sys/netinet6/nd6.c | |
| parent | 279f535b624dc68e90c6d1ff380560839e23c5cc (diff) | |
| download | FreeBSD-src-8cc0e3cda93eb82fdcd32bc3b75c038a171896c9.zip FreeBSD-src-8cc0e3cda93eb82fdcd32bc3b75c038a171896c9.tar.gz | |
fix two use after frees in nd6_cache_lladdr caused by last minute unlock shuffling
Diffstat (limited to 'sys/netinet6/nd6.c')
| -rw-r--r-- | sys/netinet6/nd6.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c index 5095d23..bde9ebf 100644 --- a/sys/netinet6/nd6.c +++ b/sys/netinet6/nd6.c @@ -1405,6 +1405,7 @@ nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr, int llchange; int flags = 0; int newstate = 0; + uint16_t router; struct sockaddr_in6 sin6; struct mbuf *chain = NULL; @@ -1599,11 +1600,14 @@ nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr, } if (ln) { + int static_route = (ln->la_flags & LLE_STATIC); + router = ln->ln_router; + if (flags & ND6_EXCLUSIVE) LLE_WUNLOCK(ln); else LLE_RUNLOCK(ln); - if (ln->la_flags & LLE_STATIC) + if (static_route) ln = NULL; } if (chain) @@ -1624,7 +1628,7 @@ nd6_cache_lladdr(struct ifnet *ifp, struct in6_addr *from, char *lladdr, * for those are not autoconfigured hosts, we explicitly avoid such * cases for safety. */ - if (do_update && ln->ln_router && !V_ip6_forwarding && V_ip6_accept_rtadv) { + if (do_update && router && !V_ip6_forwarding && V_ip6_accept_rtadv) { /* * guaranteed recursion */ |
