diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2019-05-13 18:14:06 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2019-05-13 18:14:06 +0000 |
| commit | 40472cab3b27dcfe8cf3d6e4aae91f62354355ca (patch) | |
| tree | bf64185a5a73ecdc676c3ca5d21db247bb2ca05b /sys/net/if_bridge.c | |
| parent | 9ebccbfd943ee0a8eab4e5e40cddbba63e4f8600 (diff) | |
Deal with the case where bridge_getbif() can return NULL.
Since `bif' are removed from the interface list before calling smr_barrier()
and the hash queue is cleaned up afterward, it is possible to find an ifidx
with bridge_rtlookup() that won't match to any `bif'.
Fix a panic reported by Hrvoje Popovski, ok visa@
Diffstat (limited to 'sys/net/if_bridge.c')
| -rw-r--r-- | sys/net/if_bridge.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index 42d4a8b8503..1d178dc4d22 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bridge.c,v 1.332 2019/05/12 19:53:22 mpi Exp $ */ +/* $OpenBSD: if_bridge.c,v 1.333 2019/05/13 18:14:05 mpi Exp $ */ /* * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) @@ -1042,8 +1042,8 @@ bridgeintr_frame(struct ifnet *brifp, struct ifnet *src_if, struct mbuf *m) if (!ISSET(dst_if->if_flags, IFF_RUNNING)) goto bad; bif = bridge_getbif(dst_if); - if ((bif->bif_flags & IFBIF_STP) && - (bif->bif_state == BSTP_IFSTATE_DISCARDING)) + if ((bif == NULL) || ((bif->bif_flags & IFBIF_STP) && + (bif->bif_state == BSTP_IFSTATE_DISCARDING))) goto bad; /* * Do not transmit if both ports are part of the same protected @@ -1251,6 +1251,7 @@ bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp, u_int32_t protected; bif = bridge_getbif(ifp); + KASSERT(bif != NULL); protected = bif->bif_protected; SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) { |