[src/trunk]: src/sys/dev/pci Use-after-free.

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c6530f90cce4
branches:  trunk
changeset: 339141:c6530f90cce4
user:      maxv <maxv%NetBSD.org@localhost>
date:      Mon Jun 29 12:27:41 2015 +0000

description:
Use-after-free.

ok christos@

Found by Brainy.

diffstat:

 sys/dev/pci/if_et.c |  6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diffs (34 lines):

diff -r 4276b483132b -r c6530f90cce4 sys/dev/pci/if_et.c
--- a/sys/dev/pci/if_et.c       Mon Jun 29 09:40:36 2015 +0000
+++ b/sys/dev/pci/if_et.c       Mon Jun 29 12:27:41 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $       */
+/*     $NetBSD: if_et.c,v 1.9 2015/06/29 12:27:41 maxv Exp $   */
 /*     $OpenBSD: if_et.c,v 1.11 2008/06/08 06:18:07 jsg Exp $  */
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.9 2015/06/29 12:27:41 maxv Exp $");
 
 #include "opt_inet.h"
 #include "vlan.h"
@@ -1823,7 +1823,6 @@
 
                MGETHDR(m_new, M_DONTWAIT, MT_DATA);
                if (m_new == NULL) {
-                       m_freem(m);
                        aprint_error_dev(sc->sc_dev, "can't defrag TX mbuf\n");
                        error = ENOBUFS;
                        goto back;
@@ -1833,7 +1832,6 @@
                if (m->m_pkthdr.len > MHLEN) {
                        MCLGET(m_new, M_DONTWAIT);
                        if (!(m_new->m_flags & M_EXT)) {
-                               m_freem(m);
                                m_freem(m_new);
                                error = ENOBUFS;
                        }