svn commit: r215745 - stable/8/sys/netgraph

[Marko Zec]

Author: zec
Date: Tue Nov 23 13:28:45 2010
New Revision: 215745
URL: http://svn.freebsd.org/changeset/base/215745

Log:
  MFC 209723:
  
     Fix a double-free bug which can occur if both bit error rate and
     packet duplication probability are configured on a ng_pipe node.
  
     Submitted by:   Jeffrey Ahrenholtz
     MFC after:	   3 days

Modified:
  stable/8/sys/netgraph/ng_pipe.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/netgraph/ng_pipe.c
==============================================================================
--- stable/8/sys/netgraph/ng_pipe.c	Tue Nov 23 13:26:59 2010	(r215744)
+++ stable/8/sys/netgraph/ng_pipe.c	Tue Nov 23 13:28:45 2010	(r215745)
@@ -779,8 +779,9 @@ pipe_dequeue(struct hookinfo *hinfo, str
 		    random() % 100 <= hinfo->cfg.duplicate) {
 			ngp_h = uma_zalloc(ngp_zone, M_NOWAIT);
 			KASSERT(ngp_h != NULL, ("ngp_h zalloc failed (3)"));
-			ngp_h->m = m_dup(m, M_NOWAIT);
-			KASSERT(ngp_h->m != NULL, ("m_dup failed"));
+			m = m_dup(m, M_NOWAIT);
+			KASSERT(m != NULL, ("m_dup failed"));
+			ngp_h->m = m;
 		} else {
 			TAILQ_REMOVE(&ngp_f->packet_head, ngp_h, ngp_link);
 			hinfo->run.qin_frames--;