diff options
| author | zec <zec@FreeBSD.org> | 2010-07-06 12:13:15 +0000 |
|---|---|---|
| committer | zec <zec@FreeBSD.org> | 2010-07-06 12:13:15 +0000 |
| commit | da1f525af04cd62596668038387a53d2eedd6b09 (patch) | |
| tree | 8c7589e653a640de1fbfe64cacf4878e079fa8eb | |
| parent | ffe13fc70526df50c4b8f7c0b7c83630c6fad5bf (diff) | |
| download | FreeBSD-src-da1f525af04cd62596668038387a53d2eedd6b09.zip FreeBSD-src-da1f525af04cd62596668038387a53d2eedd6b09.tar.gz | |
Fix a double-free bug which can occur if both bit error rate and packet
duplication probability are configured on a ng_pipe node.
Submitted by: Jeffrey Ahrenholtz
MFC after: 3 days
| -rw-r--r-- | sys/netgraph/ng_pipe.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/netgraph/ng_pipe.c b/sys/netgraph/ng_pipe.c index a454624..77009bf 100644 --- a/sys/netgraph/ng_pipe.c +++ b/sys/netgraph/ng_pipe.c @@ -779,8 +779,9 @@ pipe_dequeue(struct hookinfo *hinfo, struct timeval *now) { random() % 100 <= hinfo->cfg.duplicate) { ngp_h = uma_zalloc(ngp_zone, M_NOWAIT); KASSERT(ngp_h != NULL, ("ngp_h zalloc failed (3)")); - ngp_h->m = m_dup(m, M_NOWAIT); - KASSERT(ngp_h->m != NULL, ("m_dup failed")); + m = m_dup(m, M_NOWAIT); + KASSERT(m != NULL, ("m_dup failed")); + ngp_h->m = m; } else { TAILQ_REMOVE(&ngp_f->packet_head, ngp_h, ngp_link); hinfo->run.qin_frames--; |
