Module Name: src
Committed By: maxv
Date: Mon May 7 09:41:10 UTC 2018
Modified Files:
src/sys/dev/marvell: mvxpbm.c
Log Message:
Fix double-free, m_tag_delete_chain is already called by m_free.
To generate a diff of this commit:
cvs rdiff -u -r1.1 -r1.2 src/sys/dev/marvell/mvxpbm.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/marvell/mvxpbm.c
diff -u src/sys/dev/marvell/mvxpbm.c:1.1 src/sys/dev/marvell/mvxpbm.c:1.2
--- src/sys/dev/marvell/mvxpbm.c:1.1 Wed Jun 3 03:55:47 2015
+++ src/sys/dev/marvell/mvxpbm.c Mon May 7 09:41:10 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: mvxpbm.c,v 1.1 2015/06/03 03:55:47 hsuenaga Exp $ */
+/* $NetBSD: mvxpbm.c,v 1.2 2018/05/07 09:41:10 maxv Exp $ */
/*
* Copyright (c) 2015 Internet Initiative Japan Inc.
* All rights reserved.
@@ -25,7 +25,7 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mvxpbm.c,v 1.1 2015/06/03 03:55:47 hsuenaga Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mvxpbm.c,v 1.2 2018/05/07 09:41:10 maxv Exp $");
#include "opt_multiprocessor.h"
@@ -322,8 +322,7 @@ mvxpbm_free_mbuf(struct mbuf *m, void *b
KASSERT(arg != NULL);
DPRINTFN(3, "free packet %p\n", m);
- if (m->m_flags & M_PKTHDR)
- m_tag_delete_chain((m), NULL);
+
chunk->m = NULL;
s = splvm();
pool_cache_put(mb_cache, m);
