diff options
| author | Markus Friedl <markus@cvs.openbsd.org> | 2012-05-09 06:50:56 +0000 |
|---|---|---|
| committer | Markus Friedl <markus@cvs.openbsd.org> | 2012-05-09 06:50:56 +0000 |
| commit | 4cd6b1856b89c7e18377a7c4a879177310193a3e (patch) | |
| tree | 4437ff017bb382541497cc20a7637aa4b7bddfc0 /sys/net/route.c | |
| parent | 03d0e05026500345f906e803234d2900e1c38b9f (diff) | |
backout 1.134 since it introduced a use-after-free for routing entries;
ok blambert@ sthen@ henning@ claudio@
Diffstat (limited to 'sys/net/route.c')
| -rw-r--r-- | sys/net/route.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/net/route.c b/sys/net/route.c index 14f7a1f13c3..c0c7c03ae84 100644 --- a/sys/net/route.c +++ b/sys/net/route.c @@ -1,4 +1,4 @@ -/* $OpenBSD: route.c,v 1.135 2011/12/06 12:58:34 blambert Exp $ */ +/* $OpenBSD: route.c,v 1.136 2012/05/09 06:50:55 markus Exp $ */ /* $NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $ */ /* @@ -551,10 +551,15 @@ rtdeletemsg(struct rtentry *rt, u_int tableid) info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; info.rti_flags = rt->rt_flags; ifp = rt->rt_ifp; - error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, NULL, tableid); + error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, &rt, tableid); rt_missmsg(RTM_DELETE, &info, info.rti_flags, ifp, error, tableid); + /* Adjust the refcount */ + if (error == 0 && rt->rt_refcnt <= 0) { + rt->rt_refcnt++; + rtfree(rt); + } return (error); } |