hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2025-01-01 00:18:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Like with r185713 make sure to not leak a lock as rtalloc1(9) returns

Browse Source 
a locked route. Thus we have to use RTFREE_LOCKED(9) to get it unlocked
and rtfree(9)d rather than just rtfree(9)d.

Since the PR was filed, new places with the same problem were added
with new code.  Also check that the rt is valid before freeing it
either way there.

PR:		kern/129793
Submitted by:	Dheeraj Reddy <dheeraj@ece.gatech.edu>
MFC after:	2 weeks
Committed from:	Bugathon #6
This commit is contained in:
Bjoern A. Zeeb 2009-01-31 10:48:02 +00:00
parent becc630684
commit 2e730bea0a
5 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/net/if_llatbl.c
View File

@ -219,10 +219,11 @@ lla_rt_output(struct rt_msghdr *rtm, struct rt_addrinfo *info)
log(LOG_INFO, "%s: RTM_ADD publish "
"(proxy only) is invalid\n",
__func__);
RTFREE(rt);
if (rt)
RTFREE_LOCKED(rt);
return EINVAL;
}
RTFREE(rt);
RTFREE_LOCKED(rt);
flags |= LLE_PROXY;
}

6
sys/netinet6/in6.c
View File

@ -2122,16 +2122,16 @@ in6_lltable_rtcheck(struct ifnet *ifp, const struct sockaddr *l3addr)
ifa = ifaof_ifpforaddr(__DECONST(struct sockaddr *, l3addr), ifp);
if (ifa != NULL) {
if (rt != NULL)
rtfree(rt);
RTFREE_LOCKED(rt);
return 0;
}
log(LOG_INFO, "IPv6 address: \"%s\" is not on the network\n",
ip6_sprintf(ip6buf, &((const struct sockaddr_in6 *)l3addr)->sin6_addr));
if (rt != NULL)
rtfree(rt);
RTFREE_LOCKED(rt);
return EINVAL;
}
rtfree(rt);
RTFREE_LOCKED(rt);
return 0;
}

4
sys/netinet6/in6_gif.c
View File

@ -378,10 +378,10 @@ gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
ip6_sprintf(ip6buf, &sin6.sin6_addr));
#endif
if (rt)
rtfree(rt);
RTFREE_LOCKED(rt);
return 0;
}
rtfree(rt);
RTFREE_LOCKED(rt);
}
return 128 * 2;

2
sys/netinet6/in6_ifattach.c
View File

@ -778,7 +778,7 @@ in6_ifdetach(struct ifnet *ifp)
if ((ia->ia_flags & IFA_ROUTE) &&
(rt = rtalloc1((struct sockaddr *)&ia->ia_addr, 0, 0UL))) {
rtflags = rt->rt_flags;
rtfree(rt);
RTFREE_LOCKED(rt);
rtrequest(RTM_DELETE, (struct sockaddr *)&ia->ia_addr,
(struct sockaddr *)&ia->ia_addr,
(struct sockaddr *)&ia->ia_prefixmask,

2
sys/netinet6/nd6_nbr.c
View File

@ -259,7 +259,7 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
need_proxy = (rt && (rt->rt_flags & RTF_ANNOUNCE) != 0 &&
rt->rt_gateway->sa_family == AF_LINK);
if (rt)
rtfree(rt);
RTFREE_LOCKED(rt);
if (need_proxy) {
/*
* proxy NDP for single entry