svn commit: r236575 - head/sys/netinet

[Maksim Yevmenkin]

Author: emax
Date: Mon Jun  4 18:43:51 2012
New Revision: 236575
URL: http://svn.freebsd.org/changeset/base/236575

Log:
  Plug more refcount leaks and possible NULL deref for interface
  address list.
  
  Submitted by:	scottl@
  MFC after:	3 days

Modified:
  head/sys/netinet/tcp_input.c

Modified: head/sys/netinet/tcp_input.c
==============================================================================
--- head/sys/netinet/tcp_input.c	Mon Jun  4 18:17:09 2012	(r236574)
+++ head/sys/netinet/tcp_input.c	Mon Jun  4 18:43:51 2012	(r236575)
@@ -512,6 +512,8 @@ tcp6_input(struct mbuf **mp, int *offp, 
 			    (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
 		return IPPROTO_DONE;
 	}
+	if (ia6)
+		ifa_free(&ia6->ia_ifa);
 
 	tcp_input(m, *offp);
 	return IPPROTO_DONE;
@@ -1240,7 +1242,8 @@ relocked:
 				rstreason = BANDLIM_RST_OPENPORT;
 				goto dropwithreset;
 			}
-			ifa_free(&ia6->ia_ifa);
+			if (ia6)
+				ifa_free(&ia6->ia_ifa);
 		}
 #endif /* INET6 */
 		/*