From 4cf39b5da412b16921f3a52d1fdbdec76897bb68 Mon Sep 17 00:00:00 2001 From: Max Khon Date: Sun, 6 Nov 2011 05:24:54 +0000 Subject: [PATCH] - Fix potential double mbuf free: M_PREPEND may free mbuf chain and return NULL but item will still have the reference ot the mbuf chain and will free it upon destruction. - Fix memory leak (unfree'd item on error path). --- sys/netgraph/ng_atmllc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/netgraph/ng_atmllc.c b/sys/netgraph/ng_atmllc.c index 336d4b16e73..3ba9dff75ae 100644 --- a/sys/netgraph/ng_atmllc.c +++ b/sys/netgraph/ng_atmllc.c @@ -153,7 +153,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) int error; priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); - m = NGI_M(item); + NGI_GET_M(item, m); outhook = NULL; padding = 0; @@ -170,6 +170,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) if (m->m_len < sizeof(struct atmllc) + ETHER_HDR_LEN) { m = m_pullup(m, sizeof(struct atmllc) + ETHER_HDR_LEN); if (m == NULL) { + NG_FREE_ITEM(item); return (ENOMEM); } } @@ -236,6 +237,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item) } if (outhook == NULL) { + NG_FREE_M(m); NG_FREE_ITEM(item); return (0); }