Date: Sun, 6 Nov 2011 05:24:54 +0000 (UTC) From: Max Khon <fjoe@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r227132 - head/sys/netgraph Message-ID: <201111060524.pA65OsVj000842@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: fjoe Date: Sun Nov 6 05:24:54 2011 New Revision: 227132 URL: http://svn.freebsd.org/changeset/base/227132 Log: - Fix potential double mbuf free: M_PREPEND may free mbuf chain and return NULL but item will still have the reference ot the mbuf chain and will free it upon destruction. - Fix memory leak (unfree'd item on error path). Modified: head/sys/netgraph/ng_atmllc.c Modified: head/sys/netgraph/ng_atmllc.c ============================================================================== --- head/sys/netgraph/ng_atmllc.c Sun Nov 6 05:23:42 2011 (r227131) +++ head/sys/netgraph/ng_atmllc.c Sun Nov 6 05:24:54 2011 (r227132) @@ -153,7 +153,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p it int error; priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); - m = NGI_M(item); + NGI_GET_M(item, m); outhook = NULL; padding = 0; @@ -170,6 +170,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p it if (m->m_len < sizeof(struct atmllc) + ETHER_HDR_LEN) { m = m_pullup(m, sizeof(struct atmllc) + ETHER_HDR_LEN); if (m == NULL) { + NG_FREE_ITEM(item); return (ENOMEM); } } @@ -236,6 +237,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p it } if (outhook == NULL) { + NG_FREE_M(m); NG_FREE_ITEM(item); return (0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201111060524.pA65OsVj000842>