Date: Sun, 6 Nov 2011 05:23:42 +0000 (UTC) From: Max Khon <fjoe@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r227131 - head/sys/netgraph Message-ID: <201111060523.pA65NgdP000775@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: fjoe Date: Sun Nov 6 05:23:42 2011 New Revision: 227131 URL: http://svn.freebsd.org/changeset/base/227131 Log: Fix potential double mbuf free: M_PREPEND may free mbuf chain and return NULL but item will still have the reference ot the mbuf chain and will free it upon destruction. Modified: head/sys/netgraph/ng_cisco.c Modified: head/sys/netgraph/ng_cisco.c ============================================================================== --- head/sys/netgraph/ng_cisco.c Sun Nov 6 05:20:27 2011 (r227130) +++ head/sys/netgraph/ng_cisco.c Sun Nov 6 05:23:42 2011 (r227131) @@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item) /* OK so it came from a protocol, heading out. Prepend general data packet header. For now, IP,IPX only */ - m = NGI_M(item); /* still associated with item */ + NGI_GET_M(item, m); M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT); if (!m) { error = ENOBUFS; goto out; } + NGI_M(item) = m; h = mtod(m, struct cisco_header *); h->address = CISCO_UNICAST; h->control = 0;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201111060523.pA65NgdP000775>