diff options
| author | mvs <mvs@cvs.openbsd.org> | 2021-05-16 13:09:40 +0000 |
|---|---|---|
| committer | mvs <mvs@cvs.openbsd.org> | 2021-05-16 13:09:40 +0000 |
| commit | 6e9b6d11f44751130492d934121c975470d23fc7 (patch) | |
| tree | 72ac004ba9ec6652f2012111d81b3da260c522ff /sys/net/wg_cookie.c | |
| parent | a85d436e698576aa23de7089d798c5b9b397b215 (diff) | |
In route detach we delete `rop_timeout' while `rop' is still linked to
`rtp_list' so it could be re-added by concurrent thread. Also
timeout_del(9) doesn't wait timeout proc to be finished and
timeout_del_barrier(9) should be used for that.
So use timeout_del_barrier(9) instead of timeout_del(9) and moved it
just after refcnt_finalize(9). This fixes potential use-after-free
issue in route_detach().
ok mpi@
Diffstat (limited to 'sys/net/wg_cookie.c')
0 files changed, 0 insertions, 0 deletions