diff options
| author | will <will@FreeBSD.org> | 2013-04-08 23:16:42 +0000 |
|---|---|---|
| committer | will <will@FreeBSD.org> | 2013-04-08 23:16:42 +0000 |
| commit | 528b271d19c1d99c4810f13ed1b36d4c80383306 (patch) | |
| tree | 7d4ff2c0ef2443026a6d5a7ffba5cc59f268fc07 /sys/netinet6/raw_ip6.c | |
| parent | 74834df233e9efeb8a4329be847e94307006b641 (diff) | |
| download | FreeBSD-src-528b271d19c1d99c4810f13ed1b36d4c80383306.zip FreeBSD-src-528b271d19c1d99c4810f13ed1b36d4c80383306.tar.gz | |
FireWire: Don't allow a tlabel to reference an xfer after free.
sys/dev/firewire/firewire.c:
- fw_xfer_unload(): Since we are about to free this xfer, call fw_tl_free()
to remove the xfer from its tlabel's list, if it has a tlabel.
- In every occasion when a xfer is removed from a tlabel's list, reset
xfer->tl to -1 while holding fc->tlabel_lock, so that the xfer isn't
mis-identified as belonging to a tlabel.
This doesn't fix all the use-after-free problems for M_FWMEM, but is an
incremental towards that goal.
Reviewed by: kan, sbruno
Sponsored by: Spectra Logic
Diffstat (limited to 'sys/netinet6/raw_ip6.c')
0 files changed, 0 insertions, 0 deletions
