From c19c5239a668c6cef1c5ea25537fab4d7921f85f Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Thu, 12 Aug 2004 01:34:27 +0000
Subject: [PATCH] When udp_send() fails, make sure to free the control mbufs as
 well as the data mbuf.  This was done in most error cases, but not the case
 where the inpcb pointer is surprisingly NULL.

---
 sys/netinet/udp_usrreq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index dc95f4bd2cb..ef084a3ae80 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1072,6 +1072,8 @@ udp_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
 	if (inp == 0) {
 		INP_INFO_WUNLOCK(&udbinfo);
 		m_freem(m);
+		if (control != NULL)
+			m_freem(control);
 		return EINVAL;
 	}
 	INP_LOCK(inp);