[src/trunk]: src/sys/net Avoid a dangling pointer during rt_replace_ifa

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/309046a7f6df
branches:  trunk
changeset: 445449:309046a7f6df
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Tue Oct 30 05:30:31 2018 +0000

description:
Avoid a dangling pointer during rt_replace_ifa

diffstat:

 sys/net/route.c |  12 +++++++++---
 1 files changed, 9 insertions(+), 3 deletions(-)

diffs (41 lines):

diff -r 0233d32c063d -r 309046a7f6df sys/net/route.c
--- a/sys/net/route.c   Tue Oct 30 05:29:21 2018 +0000
+++ b/sys/net/route.c   Tue Oct 30 05:30:31 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: route.c,v 1.213 2018/09/05 02:49:40 ozaki-r Exp $      */
+/*     $NetBSD: route.c,v 1.214 2018/10/30 05:30:31 ozaki-r Exp $      */
 
 /*-
  * Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -97,7 +97,7 @@
 #endif
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.213 2018/09/05 02:49:40 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: route.c,v 1.214 2018/10/30 05:30:31 ozaki-r Exp $");
 
 #include <sys/param.h>
 #ifdef RTFLUSH_DEBUG
@@ -406,6 +406,11 @@
 void
 rt_replace_ifa(struct rtentry *rt, struct ifaddr *ifa)
 {
+       struct ifaddr *old;
+
+       if (rt->rt_ifa == ifa)
+               return;
+
        if (rt->rt_ifa &&
            rt->rt_ifa != ifa &&
            rt->rt_ifa->ifa_flags & IFA_ROUTE &&
@@ -424,8 +429,9 @@
        }
 
        ifaref(ifa);
-       ifafree(rt->rt_ifa);
+       old = rt->rt_ifa;
        rt_set_ifa1(rt, ifa);
+       ifafree(old);
 }
 
 static void