Author: rmacklem
Date: Wed Apr 27 01:33:12 2011
New Revision: 221104
URL: http://svn.freebsd.org/changeset/base/221104

Log:
  MFC: r220585
  Fix a couple of mbuf leaks introduced by r217242. I do
  not believe that these leaks had a practical impact,
  since the situations in which they would have occurred
  would have been extremely rare.

Modified:
  stable/8/sys/rpc/clnt_dg.c
  stable/8/sys/rpc/clnt_vc.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)

Modified: stable/8/sys/rpc/clnt_dg.c
==============================================================================
--- stable/8/sys/rpc/clnt_dg.c  Wed Apr 27 01:10:15 2011        (r221103)
+++ stable/8/sys/rpc/clnt_dg.c  Wed Apr 27 01:33:12 2011        (r221104)
@@ -1086,11 +1086,13 @@ clnt_dg_soupcall(struct socket *so, void
                /*
                 * The XID is in the first uint32_t of the reply.
                 */
-               if (m->m_len < sizeof(xid) && m_length(m, NULL) < sizeof(xid))
+               if (m->m_len < sizeof(xid) && m_length(m, NULL) < sizeof(xid)) {
                        /*
                         * Should never happen.
                         */
+                       m_freem(m);
                        continue;
+               }
 
                m_copydata(m, 0, sizeof(xid), (char *)&xid);
                xid = ntohl(xid);

Modified: stable/8/sys/rpc/clnt_vc.c
==============================================================================
--- stable/8/sys/rpc/clnt_vc.c  Wed Apr 27 01:10:15 2011        (r221103)
+++ stable/8/sys/rpc/clnt_vc.c  Wed Apr 27 01:33:12 2011        (r221104)
@@ -973,8 +973,11 @@ clnt_vc_soupcall(struct socket *so, void
                                 * the reply.
                                 */
                                if (ct->ct_record->m_len < sizeof(xid) &&
-                                   m_length(ct->ct_record, NULL) < sizeof(xid))
+                                   m_length(ct->ct_record, NULL) <
+                                   sizeof(xid)) {
+                                       m_freem(ct->ct_record);
                                        break;
+                               }
                                m_copydata(ct->ct_record, 0, sizeof(xid),
                                    (char *)&xid);
                                xid = ntohl(xid);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to