d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix potential double mbuf free: M_PREPEND may free mbuf chain and return

Browse Source 
NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
This commit is contained in:
Max Khon 2011-11-06 05:23:42 +00:00
parent 707d205808
commit 6812e78328
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=227131
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/netgraph/ng_cisco.c
View File

@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item)
/* OK so it came from a protocol, heading out. Prepend general data
packet header. For now, IP,IPX only */
m = NGI_M(item); /* still associated with item */
NGI_GET_M(item, m);
M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT);
if (!m) {
error = ENOBUFS;
goto out;
}
NGI_M(item) = m;
h = mtod(m, struct cisco_header *);
h->address = CISCO_UNICAST;
h->control = 0;