`bd_bufsize' can change via the BIOCSBLEN ioctl(2) but iff the
descriptor hasn't been linked to an interface.  Which means the
buffers haven't been allocated yet.

ok?

Index: net/bpf.c
===================================================================
RCS file: /cvs/src/sys/net/bpf.c,v
retrieving revision 1.175
diff -u -p -r1.175 bpf.c
--- net/bpf.c   18 May 2019 12:59:32 -0000      1.175
+++ net/bpf.c   10 Jun 2019 16:42:56 -0000
@@ -1579,9 +1579,9 @@ bpf_d_smr(void *smr)
 {
        struct bpf_d    *bd = smr;
 
-       free(bd->bd_sbuf, M_DEVBUF, 0);
-       free(bd->bd_hbuf, M_DEVBUF, 0);
-       free(bd->bd_fbuf, M_DEVBUF, 0);
+       free(bd->bd_sbuf, M_DEVBUF, bd->bd_bufsize);
+       free(bd->bd_hbuf, M_DEVBUF, bd->bd_bufsize);
+       free(bd->bd_fbuf, M_DEVBUF, bd->bd_bufsize);
 
        if (bd->bd_rfilter != NULL)
                bpf_prog_smr(bd->bd_rfilter);

Reply via email to