Fix a couple of mbuf leaks introduced by r217242. I do

not believe that these leaks had a practical impact,
since the situations in which they would have occurred
would have been extremely rare.

MFC after:	2 weeks

2 files changed, 7 insertions, 2 deletions

diff --git a/sys/rpc/clnt_dg.c b/sys/rpc/clnt_dg.c
index 58d55ff..a412c08 100644
--- a/sys/rpc/clnt_dg.c
+++ b/sys/rpc/clnt_dg.c
@@ -1086,11 +1086,13 @@ clnt_dg_soupcall(struct socket *so, void *arg, int waitflag)
 		/*
 		 * The XID is in the first uint32_t of the reply.
 		 */
-		if (m->m_len < sizeof(xid) && m_length(m, NULL) < sizeof(xid))
+		if (m->m_len < sizeof(xid) && m_length(m, NULL) < sizeof(xid)) {
 			/*
 			 * Should never happen.
 			 */
+			m_freem(m);
 			continue;
+		}
 
 		m_copydata(m, 0, sizeof(xid), (char *)&xid);
 		xid = ntohl(xid);
diff --git a/sys/rpc/clnt_vc.c b/sys/rpc/clnt_vc.c
index 9f36bba..b94526d 100644
--- a/sys/rpc/clnt_vc.c
+++ b/sys/rpc/clnt_vc.c
@@ -973,8 +973,11 @@ clnt_vc_soupcall(struct socket *so, void *arg, int waitflag)
 				 * the reply.
 				 */
 				if (ct->ct_record->m_len < sizeof(xid) &&
-				    m_length(ct->ct_record, NULL) < sizeof(xid))
+				    m_length(ct->ct_record, NULL) <
+				    sizeof(xid)) {
+					m_freem(ct->ct_record);
 					break;
+				}
 				m_copydata(ct->ct_record, 0, sizeof(xid),
 				    (char *)&xid);
 				xid = ntohl(xid);