Module Name: src
Committed By: ozaki-r
Date: Wed Nov 30 02:08:57 UTC 2016
Modified Files:
src/sys/netinet6: in6_ifattach.c
Log Message:
Fix panic on destroying an interface with IPv6 addresses obtained with RA
nd6_purge depends on that IPv6 addresses are purged. If addresses remain,
pfxlist_onlink_check called from nd6_purge dereferences a dangling pointer
(ia->ia6_ndpr) that is freed before calling pfxlist_onlink_check. Fix it by
removing addresses before calling nd6_purge, which is the original behavior
that was changed by in6.c,v 1.203 and in6_ifattach.c,v 1.99.
Note that it seems the issue occurs because of a hack that forcibly destroys
prefix list entries of a given interface in nd6_purge. We should tackle the
hack in the future.
Fix PR kern/51467
To generate a diff of this commit:
cvs rdiff -u -r1.106 -r1.107 src/sys/netinet6/in6_ifattach.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
