666bd4d253
Memory is malloc'd, then a search for a match in the fragment table is made and if the fragment matches, the wrong fragment table is freed, causing a use after free panic. This commit fixes this. A symptom of the problem is a kernel page fault in bcopy() called by ipf_frag_lookup() at line 715 in ip_frag.c. Another symptom is a kernel page fault in ipf_frag_delete() when called by ipf_frag_expire() via ipf_slowtimer(). MFC after: 1 week |
||
---|---|---|
.. | ||
alpine-hal | ||
ck | ||
cloudabi | ||
dev | ||
edk2 | ||
ipfilter/netinet | ||
libfdt | ||
libnv | ||
ncsw | ||
ngatm | ||
octeon-sdk | ||
rdma/krping | ||
v4l | ||
vchiq/interface | ||
x86emu | ||
xz-embedded |