diff options
| author | Hans Petter Selasky <hselasky@FreeBSD.org> | 2019-01-24 08:25:02 +0000 |
|---|---|---|
| committer | Hans Petter Selasky <hselasky@FreeBSD.org> | 2019-01-24 08:25:02 +0000 |
| commit | dea72f062af179ccb8abe3d2e37f4eb9b1c152d4 (patch) | |
| tree | 09f57a740e31a030dc0d808f98e45ff75a40d7f1 /sys/netinet6/in6_var.h | |
| parent | 7a028976478fe28cc889bea4658f14725628432c (diff) | |
| download | src-dea72f062af179ccb8abe3d2e37f4eb9b1c152d4.tar.gz src-dea72f062af179ccb8abe3d2e37f4eb9b1c152d4.zip | |
When detaching a network interface drain the workqueue freeing the inm's
because the destructor will access the if_ioctl() callback in the ifnet
pointer which is about to be freed. This prevents use-after-free.
PR: 233535
Differential Revision: https://reviews.freebsd.org/D18887
Reviewed by: bz (net)
Tested by: ae
MFC after: 1 week
Sponsored by: Mellanox Technologies
Notes
Notes:
svn path=/head/; revision=343394
Diffstat (limited to 'sys/netinet6/in6_var.h')
| -rw-r--r-- | sys/netinet6/in6_var.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/netinet6/in6_var.h b/sys/netinet6/in6_var.h index 746aed35945c..a19747d97918 100644 --- a/sys/netinet6/in6_var.h +++ b/sys/netinet6/in6_var.h @@ -811,6 +811,7 @@ void in6m_print(const struct in6_multi *); int in6m_record_source(struct in6_multi *, const struct in6_addr *); void in6m_release_deferred(struct in6_multi *); void in6m_release_list_deferred(struct in6_multi_head *); +void in6m_release_wait(void); void ip6_freemoptions(struct ip6_moptions *); int ip6_getmoptions(struct inpcb *, struct sockopt *); int ip6_setmoptions(struct inpcb *, struct sockopt *); |