Date: Tue, 6 Jul 2010 12:13:15 +0000 (UTC) From: Marko Zec <zec@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r209723 - head/sys/netgraph Message-ID: <201007061213.o66CDFEG066006@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: zec Date: Tue Jul 6 12:13:15 2010 New Revision: 209723 URL: http://svn.freebsd.org/changeset/base/209723 Log: Fix a double-free bug which can occur if both bit error rate and packet duplication probability are configured on a ng_pipe node. Submitted by: Jeffrey Ahrenholtz MFC after: 3 days Modified: head/sys/netgraph/ng_pipe.c Modified: head/sys/netgraph/ng_pipe.c ============================================================================== --- head/sys/netgraph/ng_pipe.c Tue Jul 6 10:45:38 2010 (r209722) +++ head/sys/netgraph/ng_pipe.c Tue Jul 6 12:13:15 2010 (r209723) @@ -779,8 +779,9 @@ pipe_dequeue(struct hookinfo *hinfo, str random() % 100 <= hinfo->cfg.duplicate) { ngp_h = uma_zalloc(ngp_zone, M_NOWAIT); KASSERT(ngp_h != NULL, ("ngp_h zalloc failed (3)")); - ngp_h->m = m_dup(m, M_NOWAIT); - KASSERT(ngp_h->m != NULL, ("m_dup failed")); + m = m_dup(m, M_NOWAIT); + KASSERT(m != NULL, ("m_dup failed")); + ngp_h->m = m; } else { TAILQ_REMOVE(&ngp_f->packet_head, ngp_h, ngp_link); hinfo->run.qin_frames--;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201007061213.o66CDFEG066006>