rip6: Fix a lock order reversal in rip6_bind()
See also commit 71a1539e37
.
Reported by: syzbot+9b461b6a07a83cc10daa@syzkaller.appspotmail.com
Reported by: syzbot+b6ce0aec16f5fdab3282@syzkaller.appspotmail.com
Reviewed by: glebius
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D35472
This commit is contained in:
parent
e8955bd643
commit
a14465e1b9
@ -760,11 +760,11 @@ rip6_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
|
||||
return (EADDRNOTAVAIL);
|
||||
}
|
||||
NET_EPOCH_EXIT(et);
|
||||
INP_INFO_WLOCK(&V_ripcbinfo);
|
||||
INP_WLOCK(inp);
|
||||
INP_INFO_WLOCK(&V_ripcbinfo);
|
||||
inp->in6p_laddr = addr->sin6_addr;
|
||||
INP_WUNLOCK(inp);
|
||||
INP_INFO_WUNLOCK(&V_ripcbinfo);
|
||||
INP_WUNLOCK(inp);
|
||||
return (0);
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user