Fix potential double mbuf free: M_PREPEND may free mbuf chain and return
NULL but item will still have the reference ot the mbuf chain and will free it upon destruction.
This commit is contained in:
parent
707d205808
commit
6812e78328
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=227131
@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item)
|
||||
|
||||
/* OK so it came from a protocol, heading out. Prepend general data
|
||||
packet header. For now, IP,IPX only */
|
||||
m = NGI_M(item); /* still associated with item */
|
||||
NGI_GET_M(item, m);
|
||||
M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT);
|
||||
if (!m) {
|
||||
error = ENOBUFS;
|
||||
goto out;
|
||||
}
|
||||
NGI_M(item) = m;
|
||||
h = mtod(m, struct cisco_header *);
|
||||
h->address = CISCO_UNICAST;
|
||||
h->control = 0;
|
||||
|
Loading…
Reference in New Issue
Block a user