diff options
| author | pluknet <pluknet@FreeBSD.org> | 2011-03-21 14:19:40 +0000 |
|---|---|---|
| committer | pluknet <pluknet@FreeBSD.org> | 2011-03-21 14:19:40 +0000 |
| commit | 1231af61c3fe3cf68ce8dac91f917971217eda12 (patch) | |
| tree | 3d558a5c50cccc224ee191e2c773d4f130678001 /sys/netinet | |
| parent | a2628a4146f0692155de2cebdabbc39d0fadcd44 (diff) | |
| download | FreeBSD-src-1231af61c3fe3cf68ce8dac91f917971217eda12.zip FreeBSD-src-1231af61c3fe3cf68ce8dac91f917971217eda12.tar.gz | |
Reference ifaddr object before unlocking as it can be freed
from another context at the moment of later access.
PR: kern/155555
Submitted by: Andrew Boyer <aboyer att averesystems.com>
Approved by: avg (mentor)
MFC after: 2 weeks
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/in.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/netinet/in.c b/sys/netinet/in.c index d8c71f1..1012012 100644 --- a/sys/netinet/in.c +++ b/sys/netinet/in.c @@ -1174,8 +1174,8 @@ in_scrubprefix(struct in_ifaddr *target) * doesn't support such action. */ if ((ia->ia_flags & IFA_ROUTE) == 0 - && (ia->ia_ifp->if_type != IFT_CARP) - ) { + && (ia->ia_ifp->if_type != IFT_CARP)) { + ifa_ref(&ia->ia_ifa); IN_IFADDR_RUNLOCK(); rtinit(&(target->ia_ifa), (int)RTM_DELETE, rtinitflags(target)); @@ -1185,6 +1185,7 @@ in_scrubprefix(struct in_ifaddr *target) rtinitflags(ia) | RTF_UP); if (error == 0) ia->ia_flags |= IFA_ROUTE; + ifa_free(&ia->ia_ifa); return (error); } } |
