- Fix potential double mbuf free: M_PREPEND may free mbuf chain and return

NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
- Fix memory leak (unfree'd item on error path).

1 files changed, 3 insertions, 1 deletions

diff --git a/sys/netgraph/ng_atmllc.c b/sys/netgraph/ng_atmllc.c
index 336d4b1..3ba9dff 100644
--- a/sys/netgraph/ng_atmllc.c
+++ b/sys/netgraph/ng_atmllc.c
@@ -153,7 +153,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
 	int	error;
 
 	priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
-	m = NGI_M(item);
+	NGI_GET_M(item, m);
 	outhook = NULL;
 	padding = 0;
 
@@ -170,6 +170,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
 		if (m->m_len < sizeof(struct atmllc) + ETHER_HDR_LEN) {
 			m = m_pullup(m, sizeof(struct atmllc) + ETHER_HDR_LEN);
 			if (m == NULL) {
+				NG_FREE_ITEM(item);
 				return (ENOMEM);
 			}
 		}
@@ -236,6 +237,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
 	}
 
 	if (outhook == NULL) {
+		NG_FREE_M(m);
 		NG_FREE_ITEM(item);
 		return (0);
 	}