aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMatt Dunwoodie <ncon@mail.noconroy.net>2019-09-23 22:03:54 +0100
committerMatt Dunwoodie <ncon@mail.noconroy.net>2019-09-23 22:03:54 +0100
commit7f590df2e51dbb5d084afc2f9f6edaf2a2b51696 (patch)
tree030351e1dc9a76bd84e3289f1134a10c11f3131a
parentmpq was broken, now fixed (diff)
downloadwireguard-openbsd-7f590df2e51dbb5d084afc2f9f6edaf2a2b51696.tar.xz
wireguard-openbsd-7f590df2e51dbb5d084afc2f9f6edaf2a2b51696.zip
Fix two bugs
1) Should not free in rate limit, as it would double free in mpq 2) tag->t_state could overwrite a freed object if a long sleep occurs after mq_push.
-rw-r--r--src/if_wg.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/src/if_wg.c b/src/if_wg.c
index 35e6b92..61b3d68 100644
--- a/src/if_wg.c
+++ b/src/if_wg.c
@@ -432,8 +432,6 @@ wg_mbuf_ratelimit(struct wg_softc *sc, struct mbuf *m)
if ((error = so->so_proto->pr_usrreq(so, PRU_SEND, m,
&peernam, NULL, NULL)) != 0)
DPRINTF(sc, "unable to send: %d\n", error);
- } else {
- m_freem(m);
}
sounlock(so, s);
}
@@ -661,11 +659,11 @@ wg_encrypt(struct mbuf *m)
case WG_OK:
break;
case WG_REJECT:
+ tag->t_state = WG_PKT_STATE_REQUEUED;
if (mq_push(&p->p_outgoing, m) != 0)
counters_inc(p->p_sc->sc_if.if_counters, ifc_oqdrops);
wg_peer_init(p);
m_freem(em);
- tag->t_state = WG_PKT_STATE_REQUEUED;
return;
default:
goto free;