Author: fjoe
Date: Sun Nov 6 05:23:42 2011
New Revision: 227131
URL: http://svn.freebsd.org/changeset/base/227131
Log:
Fix potential double mbuf free: M_PREPEND may free mbuf chain and return
NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
Modified:
head/sys/netgraph/ng_cisco.c
Modified: head/sys/netgraph/ng_cisco.c
==============================================================================
--- head/sys/netgraph/ng_cisco.c Sun Nov 6 05:20:27 2011
(r227130)
+++ head/sys/netgraph/ng_cisco.c Sun Nov 6 05:23:42 2011
(r227131)
@@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item)
/* OK so it came from a protocol, heading out. Prepend general data
packet header. For now, IP,IPX only */
- m = NGI_M(item); /* still associated with item */
+ NGI_GET_M(item, m);
M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT);
if (!m) {
error = ENOBUFS;
goto out;
}
+ NGI_M(item) = m;
h = mtod(m, struct cisco_header *);
h->address = CISCO_UNICAST;
h->control = 0;
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
