diff options
| author |   claudio <claudio@openbsd.org> | 2007-07-04 12:15:53 +0000 |
|---|---|---|
| committer | claudio <claudio@openbsd.org> | 2007-07-04 12:15:53 +0000 |
| commit | 5b0dc0eb9f226ab65c61c52d0dafbab527e4e27a (patch) | |
| tree | 147e000b9b331cafdc218bc6938e263955c0a48b /sys/dev/isa/files.isa | |
| parent | add "cua" to the NAME section; (diff) | |
| download | wireguard-openbsd-5b0dc0eb9f226ab65c61c52d0dafbab527e4e27a.tar.xz wireguard-openbsd-5b0dc0eb9f226ab65c61c52d0dafbab527e4e27a.zip | |
Fix a use after free crash in in_delmulti(). If a interface is detached
before it is removed from the multicast group in_delmulti() will try to
access the no longer available ifp.
We invalidate the ifa_ifp back pointer in the ifa in if_detach() now and use
the ifa_ifp in in_delmulti() instead of the internal inm_ifp. By doing it
this way we know if the interface was removed.
This fixes a kernel panic triggered by ospfd and gif(4) tunnels.
looks good henning@ reyk@
Diffstat (limited to 'sys/dev/isa/files.isa')
0 files changed, 0 insertions, 0 deletions