diff options
| author | fjoe <fjoe@FreeBSD.org> | 2011-11-06 05:23:42 +0000 |
|---|---|---|
| committer | fjoe <fjoe@FreeBSD.org> | 2011-11-06 05:23:42 +0000 |
| commit | e5bafa39b1505c9befb314a78ed39f17b98d1698 (patch) | |
| tree | ee0a6853f9b44f19bf0282cda269f3513a1b95d8 /sys/netgraph | |
| parent | 8c3483dc98e16f8d8d35edf675f2ff893c9fc21e (diff) | |
| download | FreeBSD-src-e5bafa39b1505c9befb314a78ed39f17b98d1698.zip FreeBSD-src-e5bafa39b1505c9befb314a78ed39f17b98d1698.tar.gz | |
Fix potential double mbuf free: M_PREPEND may free mbuf chain and return
NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
Diffstat (limited to 'sys/netgraph')
| -rw-r--r-- | sys/netgraph/ng_cisco.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netgraph/ng_cisco.c b/sys/netgraph/ng_cisco.c index 76dc1ec..aa12b75 100644 --- a/sys/netgraph/ng_cisco.c +++ b/sys/netgraph/ng_cisco.c @@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item) /* OK so it came from a protocol, heading out. Prepend general data packet header. For now, IP,IPX only */ - m = NGI_M(item); /* still associated with item */ + NGI_GET_M(item, m); M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT); if (!m) { error = ENOBUFS; goto out; } + NGI_M(item) = m; h = mtod(m, struct cisco_header *); h->address = CISCO_UNICAST; h->control = 0; |
