Module Name: src
Committed By: maxv
Date: Mon Oct 31 15:27:24 UTC 2016
Modified Files:
src/sys/kern: subr_tftproot.c
Log Message:
The mbuf is freed by the protocol even on error, so always NULL the pointer
instead of double-freeing it. Indirectly pointed out by Mootja.
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 src/sys/kern/subr_tftproot.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/subr_tftproot.c
diff -u src/sys/kern/subr_tftproot.c:1.18 src/sys/kern/subr_tftproot.c:1.19
--- src/sys/kern/subr_tftproot.c:1.18 Fri Jun 10 13:27:15 2016
+++ src/sys/kern/subr_tftproot.c Mon Oct 31 15:27:24 2016
@@ -1,4 +1,4 @@
-/* $NetBSD: subr_tftproot.c,v 1.18 2016/06/10 13:27:15 ozaki-r Exp $ */
+/* $NetBSD: subr_tftproot.c,v 1.19 2016/10/31 15:27:24 maxv Exp $ */
/*-
* Copyright (c) 2007 Emmanuel Dreyfus, all rights reserved.
@@ -39,7 +39,7 @@
#include "opt_md.h"
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: subr_tftproot.c,v 1.18 2016/06/10 13:27:15 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: subr_tftproot.c,v 1.19 2016/10/31 15:27:24 maxv Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -316,16 +316,16 @@ tftproot_getfile(struct tftproot_handle
printf("\n");
/*
- * Ack the last block. so_send frees m_outbuf, therefore
- * we do not want to free it ourselves.
- * Ignore errors, as we already have the whole file.
+ * Ack the last block. Ignore errors, as we already have the whole
+ * file.
*/
if ((error = (*so->so_send)(so, mtod(m_serv, struct sockaddr *), NULL,
m_outbuf, NULL, 0, l)) != 0)
DPRINTF(("%s():%d tftproot: sosend returned %d\n",
__func__, __LINE__, error));
- else
- m_outbuf = NULL;
+
+ /* Freed by the protocol */
+ m_outbuf = NULL;
/*
* And use it as the root ramdisk.
