diff options
author | glebius <glebius@FreeBSD.org> | 2005-09-08 14:32:19 +0000 |
---|---|---|
committer | glebius <glebius@FreeBSD.org> | 2005-09-08 14:32:19 +0000 |
commit | bf3056c071eeb472dee56e24fade6b0b6e925961 (patch) | |
tree | 8732d2162d2d127be0aa509eeda3099dab355bf8 /sys/netgraph/ng_base.c | |
parent | 0743267ea67ca596ce0ce9ac95bb2bae9c7c8841 (diff) | |
download | FreeBSD-src-bf3056c071eeb472dee56e24fade6b0b6e925961.zip FreeBSD-src-bf3056c071eeb472dee56e24fade6b0b6e925961.tar.gz |
Fix an item leak, that happens when some node calls ng_callout() two
times consequently, without checking whether callout has been serviced
or not. (ng_pptpgre and ng_ppp were catched in this behavior).
- In ng_callout() save old item before calling callout_reset(). If the
latter has returned 1, then free this item.
- In ng_uncallout() clear c->c_arg.
Problem reported by: Alexandre Kardanev
Diffstat (limited to 'sys/netgraph/ng_base.c')
-rw-r--r-- | sys/netgraph/ng_base.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/netgraph/ng_base.c b/sys/netgraph/ng_base.c index 0014f5f..d37ae21 100644 --- a/sys/netgraph/ng_base.c +++ b/sys/netgraph/ng_base.c @@ -3538,7 +3538,7 @@ int ng_callout(struct callout *c, node_p node, hook_p hook, int ticks, ng_item_fn *fn, void * arg1, int arg2) { - item_p item; + item_p item, oitem; if ((item = ng_getqblk(NG_NOFLAGS)) == NULL) return (ENOMEM); @@ -3553,7 +3553,10 @@ ng_callout(struct callout *c, node_p node, hook_p hook, int ticks, NGI_FN(item) = fn; NGI_ARG1(item) = arg1; NGI_ARG2(item) = arg2; - callout_reset(c, ticks, &ng_callout_trampoline, item); + oitem = c->c_arg; + if (callout_reset(c, ticks, &ng_callout_trampoline, item) == 1 && + oitem != NULL) + NG_FREE_ITEM(oitem); return (0); } @@ -3579,6 +3582,7 @@ ng_uncallout(struct callout *c, node_p node) */ NG_FREE_ITEM(item); } + c->c_arg = NULL; return (rval); } |