svn commit: r227131 - head/sys/netgraph

[Max Khon]

Author: fjoe
Date: Sun Nov  6 05:23:42 2011
New Revision: 227131
URL: http://svn.freebsd.org/changeset/base/227131

Log:
  Fix potential double mbuf free: M_PREPEND may free mbuf chain and return
  NULL but item will still have the reference ot the mbuf chain and will free
  it upon destruction.

Modified:
  head/sys/netgraph/ng_cisco.c

Modified: head/sys/netgraph/ng_cisco.c
==============================================================================
--- head/sys/netgraph/ng_cisco.c	Sun Nov  6 05:20:27 2011	(r227130)
+++ head/sys/netgraph/ng_cisco.c	Sun Nov  6 05:23:42 2011	(r227131)
@@ -359,12 +359,13 @@ cisco_rcvdata(hook_p hook, item_p item)
 
 	/* OK so it came from a protocol, heading out. Prepend general data
 	   packet header. For now, IP,IPX only  */
-	m = NGI_M(item); /* still associated with item */
+	NGI_GET_M(item, m);
 	M_PREPEND(m, CISCO_HEADER_LEN, M_DONTWAIT);
 	if (!m) {
 		error = ENOBUFS;
 		goto out;
 	}
+	NGI_M(item) = m;
 	h = mtod(m, struct cisco_header *);
 	h->address = CISCO_UNICAST;
 	h->control = 0;