From fc779a75730f7e46f008a4bf5649eeaf5adba7cf Mon Sep 17 00:00:00 2001 From: green Date: Mon, 17 Nov 2003 03:17:49 +0000 Subject: Fix a few cases where MT_TAG-type "fake mbufs" are created on the stack, but do not have mh_nextpkt initialized. Somtimes what's there is "1", and the ip_input() code pukes trying to m_free() it, rendering divert sockets and such broken. This really underscores the need to get rid of MT_TAG. Reviewed by: rwatson --- sys/netinet/ip_input.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'sys/netinet/ip_input.c') diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index c4764b1..e582864 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -975,6 +975,7 @@ DPRINTF(("ip_input: no SP, packet discarded\n"));/*XXX*/ tag.mh_flags = PACKET_TAG_IPFORWARD; tag.mh_data = (caddr_t)args.next_hop; tag.mh_next = m; + tag.mh_nextpkt = NULL; (*inetsw[ip_protox[ip->ip_p]].pr_input)( (struct mbuf *)&tag, hlen); @@ -1922,6 +1923,7 @@ ip_forward(struct mbuf *m, int srcrt, struct sockaddr_in *next_hop) tag.mh_flags = PACKET_TAG_IPFORWARD; tag.mh_data = (caddr_t)next_hop; tag.mh_next = m; + tag.mh_nextpkt = NULL; m = (struct mbuf *)&tag; } error = ip_output(m, (struct mbuf *)0, NULL, IP_FORWARDING, 0, NULL); -- cgit v1.1