We have `pipexinq' and `pipexoutq' mbuf(9) queues to store pipex(4)

related mbufs. Each mbuf(9) passed to these queues stores the pointer to
corresponding pipex(4) session referenced as `m_pkthdr.ph_cookie'. When
session was destroyed its reference can still be in these queues so we
have use after free issue while pipexintr() dereference it.

I removed `pipexinq', `pipexoutq' and pipexintr(). This not only allows
us to avoid issue described above, but also removes unnecessary context
switch in packet processing. Also it makes code simpler.

ok mpi@ yasuoka@

1 files changed, 1 insertions, 8 deletions

diff --git a/sys/net/if.c b/sys/net/if.c
index a38bd144869..41889efbe5e 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.c,v 1.616 2020/07/24 18:17:14 mvs Exp $	*/
+/*	$OpenBSD: if.c,v 1.617 2020/08/04 09:32:05 mvs Exp $	*/
 /*	$NetBSD: if.c,v 1.35 1996/05/07 05:26:04 thorpej Exp $	*/
 
 /*
@@ -909,13 +909,6 @@ if_netisr(void *unused)
 			KERNEL_UNLOCK();
 		}
 #endif
-#ifdef PIPEX
-		if (n & (1 << NETISR_PIPEX)) {
-			KERNEL_LOCK();
-			pipexintr();
-			KERNEL_UNLOCK();
-		}
-#endif
 		t |= n;
 	}