d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix potential double mbuf free: M_PREPEND may free mbuf chain and return

Browse Source 
NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
This commit is contained in:
fjoe 2011-11-06 05:23:42 +00:00
parent 8c3483dc98
commit e5bafa39b1
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/netgraph/ng_cisco.c
View File

@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item)
/* OK so it came from a protocol, heading out. Prepend general data
packet header. For now, IP,IPX only */
m = NGI_M(item); /* still associated with item */
NGI_GET_M(item, m);
M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT);
if (!m) {
error = ENOBUFS;
goto out;
}
NGI_M(item) = m;
h = mtod(m, struct cisco_header *);
h->address = CISCO_UNICAST;
h->control = 0;