d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix mbuf leakages and remove unneccessary duplicate mbuf frees.

Browse Source 
Use the right copy of an mbuf for the IP6_EXTHDR_CHECK.

Reported by:	zec, hrs
Approved by:	bz (mentor)
This commit is contained in:
Ana Kukec 2010-08-19 23:16:44 +00:00
parent c38208ad5e
commit e7a6db7467
1 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sys/netinet6/icmp6.c
View File

@ -786,14 +786,12 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
goto freeit; goto freeit;
} }
if (send_sendso_input_hook != NULL) { if (send_sendso_input_hook != NULL) {
IP6_EXTHDR_CHECK(m, off, IP6_EXTHDR_CHECK(n, off,
icmp6len, IPPROTO_DONE); icmp6len, IPPROTO_DONE);
error = send_sendso_input_hook(n, ifp, error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len); SND_IN, ip6len);
if (error == 0) { if (error == 0)
m_freem(n); goto freeit;
return (IPPROTO_DONE);
}
/* -1 == no app on SEND socket */ /* -1 == no app on SEND socket */
nd6_rs_input(n, off, icmp6len); nd6_rs_input(n, off, icmp6len);
} else } else
@ -819,14 +817,13 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
} else } else
nd6_ra_input(m, off, icmp6len); nd6_ra_input(m, off, icmp6len);
m = NULL; m = NULL;
m_freem(n);
goto freeit; goto freeit;
} }
if (send_sendso_input_hook != NULL) { if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(n, ifp, error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len); SND_IN, ip6len);
if (error == 0) if (error == 0)
return (IPPROTO_DONE); goto freeit;
nd6_ra_input(n, off, icmp6len); nd6_ra_input(n, off, icmp6len);
} else } else
nd6_ra_input(n, off, icmp6len); nd6_ra_input(n, off, icmp6len);
@ -848,7 +845,6 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
nd6_ns_input(m, off, icmp6len); nd6_ns_input(m, off, icmp6len);
} else } else
nd6_ns_input(m, off, icmp6len); nd6_ns_input(m, off, icmp6len);
m_freem(n);
m = NULL; m = NULL;
goto freeit; goto freeit;
} }
@ -856,7 +852,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
error = send_sendso_input_hook(n, ifp, error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len); SND_IN, ip6len);
if (error == 0) if (error == 0)
return (IPPROTO_DONE); goto freeit;
nd6_ns_input(n, off, icmp6len); nd6_ns_input(n, off, icmp6len);
} else } else
nd6_ns_input(n, off, icmp6len); nd6_ns_input(n, off, icmp6len);
@ -880,7 +876,6 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
nd6_na_input(m, off, icmp6len); nd6_na_input(m, off, icmp6len);
} else } else
nd6_na_input(m, off, icmp6len); nd6_na_input(m, off, icmp6len);
m_freem(n);
m = NULL; m = NULL;
goto freeit; goto freeit;
} }
@ -888,7 +883,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
error = send_sendso_input_hook(n, ifp, error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len); SND_IN, ip6len);
if (error == 0) if (error == 0)
return (IPPROTO_DONE); goto freeit;
nd6_na_input(n, off, icmp6len); nd6_na_input(n, off, icmp6len);
} else } else
nd6_na_input(n, off, icmp6len); nd6_na_input(n, off, icmp6len);
@ -910,7 +905,6 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
icmp6_redirect_input(m, off); icmp6_redirect_input(m, off);
} else } else
icmp6_redirect_input(m, off); icmp6_redirect_input(m, off);
m_freem(n);
m = NULL; m = NULL;
goto freeit; goto freeit;
} }
@ -918,7 +912,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
error = send_sendso_input_hook(n, ifp, error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len); SND_IN, ip6len);
if (error == 0) if (error == 0)
return (IPPROTO_DONE); goto freeit;
icmp6_redirect_input(n, off); icmp6_redirect_input(n, off);
} else } else
icmp6_redirect_input(n, off); icmp6_redirect_input(n, off);