diff options
| author | Marko Zec <zec@FreeBSD.org> | 2024-05-07 15:44:09 +0000 |
|---|---|---|
| committer | Marko Zec <zec@FreeBSD.org> | 2024-05-22 17:50:29 +0000 |
| commit | b0a1a3138a37b7849d1fb735e6b5c2cd392a2e8b (patch) | |
| tree | 5d63eb65b8ce89d3eff25bc261920b84a45b8cc0 | |
| parent | 207e8cef0b363603d68a226bb03f0ff421d30dd2 (diff) | |
| download | src-b0a1a3138a37b7849d1fb735e6b5c2cd392a2e8b.tar.gz src-b0a1a3138a37b7849d1fb735e6b5c2cd392a2e8b.zip | |
fib_dxr: set fib_data field in struct dxr_aux early enough
Previously it was possible for dxr_build() to return with da->fd
unset in case of range_tbl or x_tbl malloc() failures. This
may have led to NULL ptr dereferencing in dxr_change_rib_batch().
Approved by: re (cperciva)
MFC after: 1 week
PR: 278422
(cherry picked from commit 0418d7a0903725ade71ae77c4ff900010a93a185)
| -rw-r--r-- | sys/netinet/in_fib_dxr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/in_fib_dxr.c b/sys/netinet/in_fib_dxr.c index e7eede53ea51..94f066bdf982 100644 --- a/sys/netinet/in_fib_dxr.c +++ b/sys/netinet/in_fib_dxr.c @@ -877,6 +877,7 @@ dxr_build(struct dxr *dxr) return; dxr->aux = da; da->fibnum = dxr->fibnum; + da->fd = dxr->fd; da->refcnt = 1; LIST_INIT(&da->all_chunks); LIST_INIT(&da->all_trie); @@ -907,7 +908,6 @@ dxr_build(struct dxr *dxr) trie_rebuild = 1; } #endif - da->fd = dxr->fd; microuptime(&t0); |