Module Name: src
Committed By: maxv
Date: Mon Jun 29 12:27:41 UTC 2015
Modified Files:
src/sys/dev/pci: if_et.c
Log Message:
Use-after-free.
ok christos@
Found by Brainy.
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/sys/dev/pci/if_et.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/pci/if_et.c
diff -u src/sys/dev/pci/if_et.c:1.8 src/sys/dev/pci/if_et.c:1.9
--- src/sys/dev/pci/if_et.c:1.8 Sat Mar 29 19:28:24 2014
+++ src/sys/dev/pci/if_et.c Mon Jun 29 12:27:41 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $ */
+/* $NetBSD: if_et.c,v 1.9 2015/06/29 12:27:41 maxv Exp $ */
/* $OpenBSD: if_et.c,v 1.11 2008/06/08 06:18:07 jsg Exp $ */
/*
* Copyright (c) 2007 The DragonFly Project. All rights reserved.
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.9 2015/06/29 12:27:41 maxv Exp $");
#include "opt_inet.h"
#include "vlan.h"
@@ -1823,7 +1823,6 @@ et_encap(struct et_softc *sc, struct mbu
MGETHDR(m_new, M_DONTWAIT, MT_DATA);
if (m_new == NULL) {
- m_freem(m);
aprint_error_dev(sc->sc_dev, "can't defrag TX mbuf\n");
error = ENOBUFS;
goto back;
@@ -1833,7 +1832,6 @@ et_encap(struct et_softc *sc, struct mbu
if (m->m_pkthdr.len > MHLEN) {
MCLGET(m_new, M_DONTWAIT);
if (!(m_new->m_flags & M_EXT)) {
- m_freem(m);
m_freem(m_new);
error = ENOBUFS;
}
