To avoid a possible race, release the reference to ifa after return

from nd6_dad_na_input().

Submitted by:	Alexandre Martins
MFC after:	1 week
This commit is contained in:
ae 2015-03-19 00:04:25 +00:00
parent 746d3f6f85
commit a41131da37

View File

@ -747,8 +747,8 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
*/
if (ifa
&& (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
ifa_free(ifa);
nd6_dad_na_input(ifa);
ifa_free(ifa);
goto freeit;
}