diff options
| author | mvs <mvs@cvs.openbsd.org> | 2020-08-04 09:32:06 +0000 |
|---|---|---|
| committer | mvs <mvs@cvs.openbsd.org> | 2020-08-04 09:32:06 +0000 |
| commit | 27bbfbdc14249c84adf91a61c6e7f1beea3f8c8b (patch) | |
| tree | ad840ec723aa13e70b7054442a1c3cdba1af2eab /sys/net/netisr.h | |
| parent | 8c5576158f04ff4e479af2a949b042339a0f0c63 (diff) | |
We have `pipexinq' and `pipexoutq' mbuf(9) queues to store pipex(4)
related mbufs. Each mbuf(9) passed to these queues stores the pointer to
corresponding pipex(4) session referenced as `m_pkthdr.ph_cookie'. When
session was destroyed its reference can still be in these queues so we
have use after free issue while pipexintr() dereference it.
I removed `pipexinq', `pipexoutq' and pipexintr(). This not only allows
us to avoid issue described above, but also removes unnecessary context
switch in packet processing. Also it makes code simpler.
ok mpi@ yasuoka@
Diffstat (limited to 'sys/net/netisr.h')
| -rw-r--r-- | sys/net/netisr.h | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/net/netisr.h b/sys/net/netisr.h index f5746af9243..9f34bac6123 100644 --- a/sys/net/netisr.h +++ b/sys/net/netisr.h @@ -1,4 +1,4 @@ -/* $OpenBSD: netisr.h,v 1.51 2019/08/06 22:57:54 bluhm Exp $ */ +/* $OpenBSD: netisr.h,v 1.52 2020/08/04 09:32:05 mvs Exp $ */ /* $NetBSD: netisr.h,v 1.12 1995/08/12 23:59:24 mycroft Exp $ */ /* @@ -48,7 +48,6 @@ #define NETISR_IPV6 24 /* same as AF_INET6 */ #define NETISR_ISDN 26 /* same as AF_E164 */ #define NETISR_PPP 28 /* for PPP processing */ -#define NETISR_PIPEX 27 /* for pipex processing */ #define NETISR_BRIDGE 29 /* for bridge processing */ #define NETISR_PPPOE 30 /* for pppoe processing */ #define NETISR_SWITCH 31 /* for switch dataplane */ @@ -68,7 +67,6 @@ void bridgeintr(void); void pppoeintr(void); void switchintr(void); void pfsyncintr(void); -void pipexintr(void); #define schednetisr(anisr) \ do { \ |