upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-10 09:11:07 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

cxgb: Avoid a read-after-free in get_packet() when cxgb_debug is on

Browse source 
PR:		255863
MFC after:	1 week

(cherry picked from commit 16f8f89c5c)
This commit is contained in:
Mark Johnston 2021-05-26 10:02:19 -04:00
parent b22150dadd
commit 7a67b893e8
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/dev/cxgb/cxgb_sge.c
View file

@ -2773,6 +2773,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs,
if (mh->mh_tail == NULL) {
log(LOG_ERR, "discarding intermediate descriptor entry\n");
m_freem(m);
m = NULL;
break;
}
mh->mh_tail->m_next = m;
@ -2780,7 +2781,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs,
mh->mh_head->m_pkthdr.len += len;
break;
}
if (cxgb_debug)
if (cxgb_debug && m != NULL)
printf("len=%d pktlen=%d\n", m->m_len, m->m_pkthdr.len);
done:
if (++fl->cidx == fl->size)