diff options
author | fjoe <fjoe@FreeBSD.org> | 2011-11-06 05:24:54 +0000 |
---|---|---|
committer | fjoe <fjoe@FreeBSD.org> | 2011-11-06 05:24:54 +0000 |
commit | c518069229edda1560771a9879621bf7a4f7c811 (patch) | |
tree | ef13f22074f50537a5d3c8a860597fd78c1df772 /sys/netgraph | |
parent | e5bafa39b1505c9befb314a78ed39f17b98d1698 (diff) | |
download | FreeBSD-src-c518069229edda1560771a9879621bf7a4f7c811.zip FreeBSD-src-c518069229edda1560771a9879621bf7a4f7c811.tar.gz |
- Fix potential double mbuf free: M_PREPEND may free mbuf chain and return
NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
- Fix memory leak (unfree'd item on error path).
Diffstat (limited to 'sys/netgraph')
-rw-r--r-- | sys/netgraph/ng_atmllc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/netgraph/ng_atmllc.c b/sys/netgraph/ng_atmllc.c index 336d4b1..3ba9dff 100644 --- a/sys/netgraph/ng_atmllc.c +++ b/sys/netgraph/ng_atmllc.c @@ -153,7 +153,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) int error; priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); - m = NGI_M(item); + NGI_GET_M(item, m); outhook = NULL; padding = 0; @@ -170,6 +170,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) if (m->m_len < sizeof(struct atmllc) + ETHER_HDR_LEN) { m = m_pullup(m, sizeof(struct atmllc) + ETHER_HDR_LEN); if (m == NULL) { + NG_FREE_ITEM(item); return (ENOMEM); } } @@ -236,6 +237,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) } if (outhook == NULL) { + NG_FREE_M(m); NG_FREE_ITEM(item); return (0); } |