[src/trunk]: src/sys/netinet Avoid double frees of mbuf

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ce5c150fdcd9
branches:  trunk
changeset: 348412:ce5c150fdcd9
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Tue Oct 18 01:15:20 2016 +0000

description:
Avoid double frees of mbuf

May fix one of panicks reported by Tom Ivar Helbekkmo in PR kern/51522

diffstat:

 sys/netinet/ip_input.c |  10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diffs (46 lines):

diff -r 5ea19cb91be2 -r ce5c150fdcd9 sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c    Tue Oct 18 00:16:58 2016 +0000
+++ b/sys/netinet/ip_input.c    Tue Oct 18 01:15:20 2016 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_input.c,v 1.342 2016/10/11 05:15:01 ozaki-r Exp $   */
+/*     $NetBSD: ip_input.c,v 1.343 2016/10/18 01:15:20 ozaki-r Exp $   */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.342 2016/10/11 05:15:01 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.343 2016/10/18 01:15:20 ozaki-r Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -618,6 +618,7 @@
                freed = pfil_run_hooks(inet_pfil_hook, &m, ifp, PFIL_IN) != 0;
                SOFTNET_UNLOCK();
                if (freed || m == NULL) {
+                       m = NULL;
                        goto out;
                }
                ip = mtod(m, struct ip *);
@@ -647,6 +648,7 @@
                if ((*altq_input)(m, AF_INET) == 0) {
                        /* Packet dropped by traffic conditioner. */
                        SOFTNET_UNLOCK();
+                       m = NULL;
                        goto out;
                }
                SOFTNET_UNLOCK();
@@ -660,8 +662,10 @@
         * to be sent and the original packet to be freed).
         */
        ip_nhops = 0;           /* for source routed packets */
-       if (hlen > sizeof (struct ip) && ip_dooptions(m))
+       if (hlen > sizeof (struct ip) && ip_dooptions(m)) {
+               m = NULL;
                goto out;
+       }
 
        /*
         * Check our list of addresses, to see if the packet is for us.