d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix an obvious bug from r186196 shadowing a variable, not correctly

Browse Source 
appending the new mbuf to the chain reference but possibly causing an mbuf
nextpkt loop leading to a memory used after handoff (or having been freed)
and leaking an mbuf here.

Reviewed by:	rwatson, brooks
MFC after:	3 days
This commit is contained in:
Bjoern A. Zeeb 2011-09-30 18:20:16 +00:00
parent 0e56140a1b
commit d7ae37140a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=225885
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netinet6/nd6.c
View File

@ -2042,14 +2042,15 @@ nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
if (*chain == NULL)
*chain = m;
else {
struct mbuf *m = *chain;
struct mbuf *mb;
/*
* append mbuf to end of deferred chain
*/
while (m->m_nextpkt != NULL)
m = m->m_nextpkt;
m->m_nextpkt = m;
mb = *chain;
while (mb->m_nextpkt != NULL)
mb = mb->m_nextpkt;
mb->m_nextpkt = m;
}
return (error);
}