From 4cd6b1856b89c7e18377a7c4a879177310193a3e Mon Sep 17 00:00:00 2001 From: Markus Friedl Date: Wed, 9 May 2012 06:50:56 +0000 Subject: backout 1.134 since it introduced a use-after-free for routing entries; ok blambert@ sthen@ henning@ claudio@ --- sys/net/route.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'sys/net/route.c') diff --git a/sys/net/route.c b/sys/net/route.c index 14f7a1f13c3..c0c7c03ae84 100644 --- a/sys/net/route.c +++ b/sys/net/route.c @@ -1,4 +1,4 @@ -/* $OpenBSD: route.c,v 1.135 2011/12/06 12:58:34 blambert Exp $ */ +/* $OpenBSD: route.c,v 1.136 2012/05/09 06:50:55 markus Exp $ */ /* $NetBSD: route.c,v 1.14 1996/02/13 22:00:46 christos Exp $ */ /* @@ -551,10 +551,15 @@ rtdeletemsg(struct rtentry *rt, u_int tableid) info.rti_info[RTAX_GATEWAY] = rt->rt_gateway; info.rti_flags = rt->rt_flags; ifp = rt->rt_ifp; - error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, NULL, tableid); + error = rtrequest1(RTM_DELETE, &info, rt->rt_priority, &rt, tableid); rt_missmsg(RTM_DELETE, &info, info.rti_flags, ifp, error, tableid); + /* Adjust the refcount */ + if (error == 0 && rt->rt_refcnt <= 0) { + rt->rt_refcnt++; + rtfree(rt); + } return (error); } -- cgit v1.2.3