diff options
| author | Christopher Pascoe <pascoe@cvs.openbsd.org> | 2005-10-31 01:40:55 +0000 |
|---|---|---|
| committer | Christopher Pascoe <pascoe@cvs.openbsd.org> | 2005-10-31 01:40:55 +0000 |
| commit | 2baf7171202ec4873363c3755d106694a8d433ea (patch) | |
| tree | f0996d536db5af0d0b21ae502d5a2fe2084a9a8b /sys | |
| parent | f20a4049fbec137e782214cc3ff0026082e25949 (diff) | |
Fix a TAILQ_FOREACH where the item containing the next pointer could be
freed.
ok canacar deraadt
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/ip_carp.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c index c7cdeb850c0..6ff7742497d 100644 --- a/sys/netinet/ip_carp.c +++ b/sys/netinet/ip_carp.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_carp.c,v 1.111 2005/10/24 14:31:26 mcbride Exp $ */ +/* $OpenBSD: ip_carp.c,v 1.112 2005/10/31 01:40:54 pascoe Exp $ */ /* * Copyright (c) 2002 Michael Shalayeff. All rights reserved. @@ -773,10 +773,13 @@ carpdetach(struct carp_softc *sc) void carp_ifdetach(struct ifnet *ifp) { - struct carp_softc *sc; + struct carp_softc *sc, *nextsc; + struct carp_if *cif = (struct carp_if *)ifp->if_carp; - TAILQ_FOREACH(sc, &((struct carp_if *)ifp->if_carp)->vhif_vrs, sc_list) + for (sc = TAILQ_FIRST(&cif->vhif_vrs); sc; sc = nextsc) { + nextsc = TAILQ_NEXT(sc, sc_list); carpdetach(sc); + } } int |