diff options
| author |   claudio <claudio@openbsd.org> | 2010-06-26 22:11:51 +0000 |
|---|---|---|
| committer | claudio <claudio@openbsd.org> | 2010-06-26 22:11:51 +0000 |
| commit | 36cc577159446041f90a871b9d51bad59d4d8bb7 (patch) | |
| tree | 75c613d938c4c71d70bd3e80c57ac903cfd92181 | |
| parent | Not that anyone uses it, but bring ss(4) device referencing into (diff) | |
| download | wireguard-openbsd-36cc577159446041f90a871b9d51bad59d4d8bb7.tar.xz wireguard-openbsd-36cc577159446041f90a871b9d51bad59d4d8bb7.zip | |
timeout_del() the timers before destroying an interface so that no timeout
is fired afterwards. Fixes a use after free crash.
| -rw-r--r-- | sys/net/if_gre.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c index 3db43e3e2c1..6ebf41232db 100644 --- a/sys/net/if_gre.c +++ b/sys/net/if_gre.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_gre.c,v 1.49 2010/06/26 19:49:54 claudio Exp $ */ +/* $OpenBSD: if_gre.c,v 1.50 2010/06/26 22:11:51 claudio Exp $ */ /* $NetBSD: if_gre.c,v 1.9 1999/10/25 19:18:11 drochner Exp $ */ /* @@ -180,6 +180,8 @@ gre_clone_destroy(struct ifnet *ifp) int s; s = splnet(); + timeout_del(&sc->sc_ka_snd); + timeout_del(&sc->sc_ka_hold); LIST_REMOVE(sc, sc_list); splx(s); |