diff options
| author | mvs <mvs@cvs.openbsd.org> | 2020-06-22 09:38:16 +0000 |
|---|---|---|
| committer | mvs <mvs@cvs.openbsd.org> | 2020-06-22 09:38:16 +0000 |
| commit | c82d939f1f047701dedb987e3f1d1435aac03cf1 (patch) | |
| tree | d1f14e0be8ca2a3ef77b3ecb86129271066dec14 | |
| parent | f0998e8d205e95038dd3436b7990990019a9f3b2 (diff) | |
Prevent potencial `state_list' corruption while pppac(4) destroys pipex(4)
sessions by pipex_iface_fini() or by pipex_ioctl() with `PIPEXSMODE' command.
ok yasuoka@
| -rw-r--r-- | sys/net/pipex.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/net/pipex.c b/sys/net/pipex.c index ef67645ea26..5029d86c258 100644 --- a/sys/net/pipex.c +++ b/sys/net/pipex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pipex.c,v 1.115 2020/06/18 14:20:12 mvs Exp $ */ +/* $OpenBSD: pipex.c,v 1.116 2020/06/22 09:38:15 mvs Exp $ */ /*- * Copyright (c) 2009 Internet Initiative Japan Inc. @@ -473,8 +473,10 @@ pipex_unlink_session(struct pipex_session *session) break; } #endif - + if (session->state == PIPEX_STATE_CLOSE_WAIT) + LIST_REMOVE(session, state_list); LIST_REMOVE(session, session_list); + session->state = PIPEX_STATE_CLOSED; /* if final session is destroyed, stop timer */ if (LIST_EMPTY(&pipex_session_list)) |