i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

network/stack: Return immediately from device_reader_thread after calling device_removed.

Browse Source 
Otherwise we can and will use-after-free the device structures.
It seems this code has been broken this way since it was first added
in cc8eceb0af (2010).
This commit is contained in:
Augustin Cavalier
2022-05-14 11:52:19 -04:00
parent 3ad6b5ecba
commit 9e85b9ea2a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/network/stack/device_interfaces.cpp
+3 -2
View File
@@ -42,7 +42,7 @@ static uint32 sDeviceIndex;
/*! A service thread for each device interface. It just reads as many packets /*! A service thread for each device interface. It just reads as many packets
as availabe, deframes them, and puts them into the receive queue of the as available, deframes them, and puts them into the receive queue of the
device interface. device interface.
*/ */
static status_t static status_t
@@ -69,7 +69,8 @@ device_reader_thread(void* _interface)
fifo_enqueue_buffer(&interface->receive_queue, buffer); fifo_enqueue_buffer(&interface->receive_queue, buffer);
} else if (status == B_DEVICE_NOT_FOUND) { } else if (status == B_DEVICE_NOT_FOUND) {
device_removed(device); device_removed(device);
return status;
} else { } else {
// In case of error, give the other threads some // In case of error, give the other threads some
// time to run since this is a high priority time thread. // time to run since this is a high priority time thread.