d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a panic in the IPv6 multicast code.

Browse Source 
Use LIST_FOREACH_SAFE in in6m_disconnect() since we're
deleting and freeing item from the membership list
while traversing the list.

Reviewed by:	mmacy
Sponsored by:	Netflix
This commit is contained in:
gallatin 2018-05-10 16:19:41 +00:00
parent 852722fdfd
commit 21f42492ac
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netinet6/in6_mcast.c
View File

@ -581,7 +581,7 @@ in6m_disconnect(struct in6_multi *inm)
struct ifnet *ifp;
struct ifaddr *ifa;
struct in6_ifaddr *ifa6;
struct in6_multi_mship *imm;
struct in6_multi_mship *imm, *imm_tmp;
struct ifmultiaddr *ifma, *ll_ifma;
ifp = inm->in6m_ifp;
@ -607,7 +607,8 @@ in6m_disconnect(struct in6_multi *inm)
if (ifa->ifa_addr->sa_family != AF_INET6)
continue;
ifa6 = (void *)ifa;
LIST_FOREACH(imm, &ifa6->ia6_memberships, i6mm_chain) {
LIST_FOREACH_SAFE(imm, &ifa6->ia6_memberships,
i6mm_chain, imm_tmp) {
if (inm == imm->i6mm_maddr) {
LIST_REMOVE(imm, i6mm_chain);
free(imm, M_IP6MADDR);