diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2019-05-02 16:24:33 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2019-05-02 16:24:33 +0000 |
| commit | db943570d76922df40ac7b15af4633cd7ecbf54c (patch) | |
| tree | 7577a5c217697dd6be81e78d61afa2efdba07636 /sys/net | |
| parent | e966698458c9834b9a162dc6f740a8ef5b089704 (diff) | |
Reset root port after last STP interface is removed.
Prevent use-after-free reported by Hrvoje Popovski.
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/bridgestp.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/sys/net/bridgestp.c b/sys/net/bridgestp.c index 3c8081cbdec..8484a10b9c5 100644 --- a/sys/net/bridgestp.c +++ b/sys/net/bridgestp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bridgestp.c,v 1.69 2019/04/28 22:15:57 mpi Exp $ */ +/* $OpenBSD: bridgestp.c,v 1.70 2019/05/02 16:24:32 mpi Exp $ */ /* * Copyright (c) 2000 Jason L. Wright (jason@thought.net) @@ -252,6 +252,7 @@ void bstp_set_port_proto(struct bstp_port *, int); void bstp_set_port_tc(struct bstp_port *, int); void bstp_set_timer_tc(struct bstp_port *); void bstp_set_timer_msgage(struct bstp_port *); +void bstp_reset(struct bstp_state *); int bstp_rerooted(struct bstp_state *, struct bstp_port *); u_int32_t bstp_calc_path_cost(struct bstp_port *); void bstp_notify_rtage(struct bstp_port *, int); @@ -874,11 +875,8 @@ bstp_info_superior(struct bstp_pri_vector *pv, } void -bstp_assign_roles(struct bstp_state *bs) +bstp_reset(struct bstp_state *bs) { - struct bstp_port *bp, *rbp = NULL; - struct bstp_pri_vector pv; - /* default to our priority vector */ bs->bs_root_pv = bs->bs_bridge_pv; bs->bs_root_msg_age = 0; @@ -886,6 +884,15 @@ bstp_assign_roles(struct bstp_state *bs) bs->bs_root_fdelay = bs->bs_bridge_fdelay; bs->bs_root_htime = bs->bs_bridge_htime; bs->bs_root_port = NULL; +} + +void +bstp_assign_roles(struct bstp_state *bs) +{ + struct bstp_port *bp, *rbp = NULL; + struct bstp_pri_vector pv; + + bstp_reset(bs); /* check if any received info supersedes us */ LIST_FOREACH(bp, &bs->bs_bplist, bp_next) { @@ -1838,6 +1845,7 @@ bstp_initialization(struct bstp_state *bs) if (LIST_EMPTY(&bs->bs_bplist)) { bstp_stop(bs); + bstp_reset(bs); return; } |