In ng_attach_cntl() first allocate things that may fail, and then

do the rest of initialization. This simplifies code and fixes
a double free in failure scenario.

Reviewed by:	bz

1 files changed, 15 insertions, 16 deletions

diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c
index c5d887b..f72f822 100644
--- a/sys/netgraph/ng_socket.c
+++ b/sys/netgraph/ng_socket.c
@@ -525,33 +525,32 @@ ng_attach_cntl(struct socket *so)
 {
 	struct ngsock *priv;
 	struct ngpcb *pcbp;
+	node_p node;
 	int error;
 
-	/* Allocate node private info */
-	priv = malloc(sizeof(*priv), M_NETGRAPH_SOCK, M_WAITOK | M_ZERO);
-
 	/* Setup protocol control block */
-	if ((error = ng_attach_common(so, NG_CONTROL)) != 0) {
-		free(priv, M_NETGRAPH_SOCK);
+	if ((error = ng_attach_common(so, NG_CONTROL)) != 0)
 		return (error);
-	}
 	pcbp = sotongpcb(so);
 
-	/* Link the pcb the private data. */
-	priv->ctlsock = pcbp;
-	pcbp->sockdata = priv;
-	priv->refs++;
-
-	/* Initialize mutex. */
-	mtx_init(&priv->mtx, "ng_socket", NULL, MTX_DEF);
-
 	/* Make the generic node components */
-	if ((error = ng_make_node_common(&typestruct, &priv->node)) != 0) {
-		free(priv, M_NETGRAPH_SOCK);
+	if ((error = ng_make_node_common(&typestruct, &node)) != 0) {
 		ng_detach_common(pcbp, NG_CONTROL);
 		return (error);
 	}
 
+	/* Allocate node private info */
+	priv = malloc(sizeof(*priv), M_NETGRAPH_SOCK, M_WAITOK | M_ZERO);
+
+	/* Initialize mutex. */
+	mtx_init(&priv->mtx, "ng_socket", NULL, MTX_DEF);
+
+	/* Link the pcb the private data. */
+	priv->ctlsock = pcbp;
+	pcbp->sockdata = priv;
+	priv->refs++;
+	priv->node = node;
+
 	/* Store a hint for netstat(1). */
 	priv->node_id = priv->node->nd_ID;