potential double free in ng_fec

Brooks Davis brooks at one-eyed-alien.net
Sat Apr 2 21:06:47 PST 2005


I think I've found a potential (though very very unlikely) double free
bug in netgraph/ng_fec.c.  Can someone else confirm this is correct?  I
don't have any way of testing this code.

-- Brooks

Index: ng_fec.c
===================================================================
RCS file: /home/ncvs/src/sys/netgraph/ng_fec.c,v
retrieving revision 1.17
diff -u -p -r1.17 ng_fec.c
--- ng_fec.c	8 Feb 2005 10:31:55 -0000	1.17
+++ ng_fec.c	3 Apr 2005 05:04:06 -0000
@@ -1114,7 +1114,6 @@ ng_fec_constructor(node_p node)
 
 	/* Get an interface unit number */
 	if ((error = ng_fec_get_unit(&priv->unit)) != 0) {
-		FREE(ifp, M_NETGRAPH);
 		FREE(priv, M_NETGRAPH);
 		return (error);
 	}

-- 
Any statement of the form "X is the one, true Y" is FALSE.
PGP fingerprint 655D 519C 26A7 82E7 2529  9BF0 5D8E 8BE9 F238 1AD4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20050402/48dc9809/attachment.bin


More information about the freebsd-net mailing list