Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 5 Jun 2012 11:28:57 +0000 (UTC)
From:      "Bjoern A. Zeeb" <bz@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject:   svn commit: r236610 - stable/9/sys/netinet
Message-ID:  <201206051128.q55BSvld016696@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: bz
Date: Tue Jun  5 11:28:57 2012
New Revision: 236610
URL: http://svn.freebsd.org/changeset/base/236610

Log:
  MFC r236575 (by emax):
  
   Plug more refcount leaks and possible NULL deref for interface
   address list.

Modified:
  stable/9/sys/netinet/tcp_input.c
Directory Properties:
  stable/9/sys/   (props changed)

Modified: stable/9/sys/netinet/tcp_input.c
==============================================================================
--- stable/9/sys/netinet/tcp_input.c	Tue Jun  5 11:27:11 2012	(r236609)
+++ stable/9/sys/netinet/tcp_input.c	Tue Jun  5 11:28:57 2012	(r236610)
@@ -543,6 +543,8 @@ tcp6_input(struct mbuf **mp, int *offp, 
 			    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
 		return IPPROTO_DONE;
 	}
+	if (ia6)
+		ifa_free(&ia6->ia_ifa);
 
 	tcp_input(m, *offp);
 	return IPPROTO_DONE;
@@ -1253,7 +1255,8 @@ relocked:
 				rstreason = BANDLIM_RST_OPENPORT;
 				goto dropwithreset;
 			}
-			ifa_free(&ia6->ia_ifa);
+			if (ia6)
+				ifa_free(&ia6->ia_ifa);
 		}
 #endif /* INET6 */
 		/*



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201206051128.q55BSvld016696>