Author: bz
Date: Tue Oct 4 13:31:57 2011
New Revision: 225978
URL: http://svn.freebsd.org/changeset/base/225978
Log:
MFC r225885:
Fix an obvious bug from r186196 shadowing a variable, not correctly
appending the new mbuf to the chain reference but possibly causing an mbuf
nextpkt loop leading to a memory used after handoff (or having been freed)
and leaking an mbuf here.
Reviewed by: rwatson, brooks
Modified:
stable/8/sys/netinet6/nd6.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
Modified: stable/8/sys/netinet6/nd6.c
==============================================================================
--- stable/8/sys/netinet6/nd6.c Tue Oct 4 13:24:22 2011 (r225977)
+++ stable/8/sys/netinet6/nd6.c Tue Oct 4 13:31:57 2011 (r225978)
@@ -1917,14 +1917,15 @@ nd6_output_lle(struct ifnet *ifp, struct
if (*chain == NULL)
*chain = m;
else {
- struct mbuf *m = *chain;
+ struct mbuf *mb;
/*
* append mbuf to end of deferred chain
*/
- while (m->m_nextpkt != NULL)
- m = m->m_nextpkt;
- m->m_nextpkt = m;
+ mb = *chain;
+ while (mb->m_nextpkt != NULL)
+ mb = mb->m_nextpkt;
+ mb->m_nextpkt = m;
}
return (error);
}
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
