]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
Clear 'ia' after iterating if_addrhead for unicast address matching: since
authorRobert Watson <rwatson@FreeBSD.org>
Wed, 24 Jun 2009 14:29:40 +0000 (14:29 +0000)
committerRobert Watson <rwatson@FreeBSD.org>
Wed, 24 Jun 2009 14:29:40 +0000 (14:29 +0000)
commit19e5b0a79753b0ea4372ee5ca354f55ab009bab5
tree5685212063087b1b7ebe76d0436e7e0d689061af
parent3c366f1f143098451f22f43016627539c4af324b
Clear 'ia' after iterating if_addrhead for unicast address matching: since
'ifa' was used as the TAILQ_FOREACH() iterator argument, and 'ia' was just
derived form it, it could be left non-NULL which confused later
conditional freeing code.  This could cause kernel panics if multicast IP
packets were received.  [1]

Call 'struct in_ifaddr *' in ip_rtaddr() 'ia', not 'ifa' in keeping with
normal conventions.

When 'ipstealth' is enabled returns from ip_input early, properly release
the 'ia' reference.

Reported by: lstewart, sam [1]
MFC after: 6 weeks
sys/netinet/ip_input.c