diff options
| author | markj <markj@FreeBSD.org> | 2015-04-13 01:55:42 +0000 |
|---|---|---|
| committer | markj <markj@FreeBSD.org> | 2015-04-13 01:55:42 +0000 |
| commit | 47f557e75db43cad41fe283ec73e82a323268b81 (patch) | |
| tree | c0b8a5288cf14a2b459be1e4981c42b3c21b0a7e /sys/netinet6 | |
| parent | e3b60002c6fc13783ce25894921de681a0a79f43 (diff) | |
| download | FreeBSD-src-47f557e75db43cad41fe283ec73e82a323268b81.zip FreeBSD-src-47f557e75db43cad41fe283ec73e82a323268b81.tar.gz | |
Fix a possible refcount leak in regen_tmpaddr().
public_ifa6 may be set to NULL after taking a reference to a previous
address list element. Instead, only take the reference after leaving the
loop but before releasing the address list lock.
Differential Revision: https://reviews.freebsd.org/D2253
Reviewed by: ae
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/nd6.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c index da32f07..a344d6a 100644 --- a/sys/netinet6/nd6.c +++ b/sys/netinet6/nd6.c @@ -765,11 +765,10 @@ regen_tmpaddr(struct in6_ifaddr *ia6) * address with the prefix. */ if (!IFA6_IS_DEPRECATED(it6)) - public_ifa6 = it6; - - if (public_ifa6 != NULL) - ifa_ref(&public_ifa6->ia_ifa); + public_ifa6 = it6; } + if (public_ifa6 != NULL) + ifa_ref(&public_ifa6->ia_ifa); IF_ADDR_RUNLOCK(ifp); if (public_ifa6 != NULL) { |
