CVSROOT: /cvs Module name: src Changes by: bl...@cvs.openbsd.org 2019/09/02 07:12:09
Modified files: sys/netinet : ip_mroute.c Log message: Fix a route use after free in multicast route. Move the rt_mcast_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mfc_find(), it is reference counted. Then we need a rtfree(), but not in the other caes. Move rt_timer_remove_all() into rt_mcast_del(). OK mpi@