From owner-freebsd-net@FreeBSD.ORG  Sun Apr  3 05:06:47 2005
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9148716A4CE
	for <net@freebsd.org>; Sun,  3 Apr 2005 05:06:47 +0000 (GMT)
Received: from odin.ac.hmc.edu (Odin.AC.HMC.Edu [134.173.32.75])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3C39043D46
	for <net@freebsd.org>; Sun,  3 Apr 2005 05:06:47 +0000 (GMT)
	(envelope-from brdavis@odin.ac.hmc.edu)
Received: from odin.ac.hmc.edu (localhost.localdomain [127.0.0.1])
	by odin.ac.hmc.edu (8.13.0/8.13.0) with ESMTP id j3356kX0005918
	for <net@freebsd.org>; Sat, 2 Apr 2005 21:06:46 -0800
Received: (from brdavis@localhost)
	by odin.ac.hmc.edu (8.13.0/8.13.0/Submit) id j3356kqW005917
	for net@freebsd.org; Sat, 2 Apr 2005 21:06:46 -0800
Date: Sat, 2 Apr 2005 21:06:46 -0800
From: Brooks Davis <brooks@one-eyed-alien.net>
To: net@freebsd.org
Message-ID: <20050403050646.GA5749@odin.ac.hmc.edu>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="ZPt4rx8FFjLCG7dd"
Content-Disposition: inline
User-Agent: Mutt/1.4.1i
X-Virus-Scanned: by amavisd-new
X-Spam-Status: No, hits=0.0 required=8.0 tests=none autolearn=no version=2.63
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on odin.ac.hmc.edu
Subject: potential double free in ng_fec
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Apr 2005 05:06:47 -0000


--ZPt4rx8FFjLCG7dd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

I think I've found a potential (though very very unlikely) double free
bug in netgraph/ng_fec.c.  Can someone else confirm this is correct?  I
don't have any way of testing this code.

-- Brooks

Index: ng_fec.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /home/ncvs/src/sys/netgraph/ng_fec.c,v
retrieving revision 1.17
diff -u -p -r1.17 ng_fec.c
--- ng_fec.c	8 Feb 2005 10:31:55 -0000	1.17
+++ ng_fec.c	3 Apr 2005 05:04:06 -0000
@@ -1114,7 +1114,6 @@ ng_fec_constructor(node_p node)
=20
 	/* Get an interface unit number */
 	if ((error =3D ng_fec_get_unit(&priv->unit)) !=3D 0) {
-		FREE(ifp, M_NETGRAPH);
 		FREE(priv, M_NETGRAPH);
 		return (error);
 	}

--=20
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4

--ZPt4rx8FFjLCG7dd
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCT3nmXY6L6fI4GtQRAmCfAJ9mFa313gkQlrlYBdl/1OJobTVawACgw37v
9pewucdubxxKA18ySHRC5og=
=IDXu
-----END PGP SIGNATURE-----

--ZPt4rx8FFjLCG7dd--