CVSROOT: /cvs
Module name: src
Changes by: m...@cvs.openbsd.org 2021/05/16 07:09:39
Modified files:
sys/net : rtsock.c
Log message:
In route detach we delete `rop_timeout' while `rop' is still linked to
`rtp_list' so it could be re-added by concurrent thread. Also
timeout_del(9) doesn't wait timeout proc to be finished and
timeout_del_barrier(9) should be used for that.
So use timeout_del_barrier(9) instead of timeout_del(9) and moved it
just after refcnt_finalize(9). This fixes potential use-after-free
issue in route_detach().
ok mpi@
