Fixup (hopefully) bridging + ipfw + dummynet together...

* Some dummynet code incorrectly handled a malloc()-allocated pseudo-mbuf
  header structure, called "pkt," and could consequently pollute the mbuf
  free list if it was ever passed to m_freem(). The fix involved passing not
  pkt, but essentially pkt->m_next (which is a real mbuf) to the mbuf
  utility routines.

* Also, for dummynet, in bdg_forward(), made the code copy the ethernet header
  back into the mbuf (prepended) because the dummynet code that follows expects
  it to be there but it is, unfortunately for dummynet, passed to bdg_forward
  as a seperate argument.

PRs: kern/19551 ; misc/21534 ; kern/23010
Submitted by: Thomas Moestl <tmoestl@gmx.net>
Reviewed by: bmilekic
Approved by: luigi

1 files changed, 5 insertions, 5 deletions

diff --git a/sys/netinet/ip_dummynet.c b/sys/netinet/ip_dummynet.c
index 7b1163b..f8882bb 100644
--- a/sys/netinet/ip_dummynet.c
+++ b/sys/netinet/ip_dummynet.c
@@ -404,13 +404,13 @@ transmit_event(struct dn_pipe *pipe)
 	    struct mbuf *m = (struct mbuf *)pkt ;
 	    struct ether_header hdr;
 
-	    if (m->m_len < ETHER_HDR_LEN
-	      && (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
-		m_freem(m);
+	    if (pkt->dn_m->m_len < ETHER_HDR_LEN
+	      && (pkt->dn_m = m_pullup(pkt->dn_m, ETHER_HDR_LEN)) == NULL) {
+		m_freem(pkt->dn_m);
 		break;
 	    }
-	    bcopy(mtod(m, struct ether_header *), &hdr, ETHER_HDR_LEN);
-	    m_adj(m, ETHER_HDR_LEN);
+	    bcopy(mtod(pkt->dn_m, struct ether_header *), &hdr, ETHER_HDR_LEN);
+	    m_adj(pkt->dn_m, ETHER_HDR_LEN);
 	    bdg_forward(&m, &hdr, pkt->ifp);
 	    if (m)
 		m_freem(m);