CVSROOT: /cvs
Module name: src
Changes by: bl...@cvs.openbsd.org 2019/09/02 07:12:09
Modified files:
sys/netinet : ip_mroute.c
Log message:
Fix a route use after free in multicast route. Move the rt_mcast_del()
out of the rtable_walk(). This avoids recursion to prevent stack
overflow. Also it allows freeing the route outside of the walk.
Now mrt_mcast_del() frees the route only when it is deleted from
the routing table. If that fails, it must not be freed. After the
route is returned by mfc_find(), it is reference counted. Then we
need a rtfree(), but not in the other caes.
Move rt_timer_remove_all() into rt_mcast_del().
OK mpi@
