PPP, PPPoE, fixed bug #42138, pppoe_destroy() called with wrong pointer, PPPoE control block was never freed

This commit is contained in:
Sylvain Rochet 2014-04-19 23:38:24 +02:00
parent 3fd7bc8058
commit a7745e9a86
3 changed files with 8 additions and 7 deletions

View File

@ -168,7 +168,7 @@ struct pppoe_softc {
#define pppoe_init() /* compatibility define, no initialization needed */ #define pppoe_init() /* compatibility define, no initialization needed */
err_t pppoe_create(struct netif *ethif, ppp_pcb *pcb, void (*link_status_cb)(ppp_pcb *pcb, int up), struct pppoe_softc **scptr); err_t pppoe_create(struct netif *ethif, ppp_pcb *pcb, void (*link_status_cb)(ppp_pcb *pcb, int up), struct pppoe_softc **scptr);
err_t pppoe_destroy(struct netif *ifp); err_t pppoe_destroy(struct pppoe_softc *sc);
int pppoe_connect(struct pppoe_softc *sc); int pppoe_connect(struct pppoe_softc *sc);
void pppoe_disconnect(struct pppoe_softc *sc); void pppoe_disconnect(struct pppoe_softc *sc);

View File

@ -540,7 +540,7 @@ int ppp_free(ppp_pcb *pcb) {
#if PPPOE_SUPPORT #if PPPOE_SUPPORT
if (pcb->pppoe_sc) { if (pcb->pppoe_sc) {
pppoe_destroy(&pcb->netif); pppoe_destroy(pcb->pppoe_sc);
pcb->pppoe_sc = NULL; pcb->pppoe_sc = NULL;
} }
#endif /* PPPOE_SUPPORT */ #endif /* PPPOE_SUPPORT */

View File

@ -165,17 +165,18 @@ pppoe_create(struct netif *ethif, ppp_pcb *pcb, void (*link_status_cb)(ppp_pcb *
} }
err_t err_t
pppoe_destroy(struct netif *ifp) pppoe_destroy(struct pppoe_softc *sc)
{ {
struct pppoe_softc *sc, *prev = NULL; struct pppoe_softc *cur, *prev = NULL;
for (sc = pppoe_softc_list; sc != NULL; prev = sc, sc = sc->next) { /* find previous linked list entry */
if (sc->sc_ethif == ifp) { for (cur = pppoe_softc_list; cur != NULL; prev = cur, cur = cur->next) {
if (sc == cur) {
break; break;
} }
} }
if(!(sc && (sc->sc_ethif == ifp))) { if (cur != sc) {
return ERR_IF; return ERR_IF;
} }