don't reference a pkthdr after M_MOVE_PKTHDR has "remove it"; instead

reference the pkthdr now in the destination of the move

Sponsored by:	Vernier Networks

3 files changed, 9 insertions, 11 deletions

diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index 7c07931b..c753fdc 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -233,8 +233,8 @@ looutput(ifp, m, dst, rt)
 			goto contiguousfail;
 		}
 
-		m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
-		n->m_len = m->m_pkthdr.len;
+		m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t));
+		n->m_len = n->m_pkthdr.len;
 		m_freem(m);
 		m = n;
 	}
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c
index ad40e64..d8de60c 100644
--- a/sys/netinet6/esp_input.c
+++ b/sys/netinet6/esp_input.c
@@ -814,7 +814,7 @@ noreplaycheck:
 			maxlen = MHLEN;
 			if (n)
 				M_MOVE_PKTHDR(n, m);
-			if (n && m->m_pkthdr.len > maxlen) {
+			if (n && n->m_pkthdr.len > maxlen) {
 				MCLGET(n, M_DONTWAIT);
 				maxlen = MCLBYTES;
 				if ((n->m_flags & M_EXT) == 0) {
@@ -827,16 +827,14 @@ noreplaycheck:
 				goto bad;
 			}
 
-			if (m->m_pkthdr.len <= maxlen) {
-				m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
-				n->m_len = m->m_pkthdr.len;
-				n->m_pkthdr.len = m->m_pkthdr.len;
+			if (n->m_pkthdr.len <= maxlen) {
+				m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t));
+				n->m_len = n->m_pkthdr.len;
 				n->m_next = NULL;
 				m_freem(m);
 			} else {
 				m_copydata(m, 0, maxlen, mtod(n, caddr_t));
 				n->m_len = maxlen;
-				n->m_pkthdr.len = m->m_pkthdr.len;
 				n->m_next = m;
 				m_adj(m, maxlen);
 			}
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 15a44bb..1f37bae 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -320,7 +320,7 @@ ip6_input(m)
 		MGETHDR(n, M_DONTWAIT, MT_HEADER);
 		if (n)
 			M_MOVE_PKTHDR(n, m);
-		if (n && m->m_pkthdr.len > MHLEN) {
+		if (n && n->m_pkthdr.len > MHLEN) {
 			MCLGET(n, M_DONTWAIT);
 			if ((n->m_flags & M_EXT) == 0) {
 				m_freem(n);
@@ -332,8 +332,8 @@ ip6_input(m)
 			return;	/*ENOBUFS*/
 		}
 
-		m_copydata(m, 0, m->m_pkthdr.len, mtod(n, caddr_t));
-		n->m_len = m->m_pkthdr.len;
+		m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t));
+		n->m_len = n->m_pkthdr.len;
 		m_freem(m);
 		m = n;
 	}