To avoid a possible race, release the reference to ifa after return

from nd6_dad_na_input(). Submitted by: Alexandre Martins MFC after: 1 week
int0dh · Mar 19, 2015 · a41131d · a41131d
1 parent 746d3f6
commit a41131d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
@@ -747,8 +747,8 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	 */
 	if (ifa
 	 && (((struct in6_ifaddr *)ifa)->ia6_flags & IN6_IFF_TENTATIVE)) {
-		ifa_free(ifa);
 		nd6_dad_na_input(ifa);
+		ifa_free(ifa);
 		goto freeit;
 	}