diff options
| author |   mpi <mpi@openbsd.org> | 2017-10-16 13:20:20 +0000 |
|---|---|---|
| committer | mpi <mpi@openbsd.org> | 2017-10-16 13:20:20 +0000 |
| commit | e894ca20caa4d7367fe8fe871149398dc962ded5 (patch) | |
| tree | bdc768c9c3126bfe98ae0735760a525d4159bfa3 /sys/netinet/ip_carp.c | |
| parent | Favor memmove() over memcpy() since dst and src originates from the same (diff) | |
| download | wireguard-openbsd-e894ca20caa4d7367fe8fe871149398dc962ded5.tar.xz wireguard-openbsd-e894ca20caa4d7367fe8fe871149398dc962ded5.zip | |
Handle the case where the parent of a carp(4) is being destroyed
while packets where being passed to IPsec tasks.
Found the hardway by Hrvoje Popovski.
ok phessler@, claudio@
Diffstat (limited to '')
| -rw-r--r-- | sys/netinet/ip_carp.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c index abb4766fb26..649c7501798 100644 --- a/sys/netinet/ip_carp.c +++ b/sys/netinet/ip_carp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_carp.c,v 1.316 2017/10/09 08:35:38 mpi Exp $ */ +/* $OpenBSD: ip_carp.c,v 1.317 2017/10/16 13:20:20 mpi Exp $ */ /* * Copyright (c) 2002 Michael Shalayeff. All rights reserved. @@ -2359,7 +2359,14 @@ carp_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa, struct srp_ref sr; int ismaster; - KASSERT(sc->sc_carpdev != NULL); + /* + * If the parent of this carp(4) got destroyed while + * `m' was being processed, silently drop it. + */ + if (sc->sc_carpdev == NULL) { + m_freem(m); + return (0); + } if (sc->cur_vhe == NULL) { vhe = SRPL_FIRST(&sr, &sc->carp_vhosts); |