[src/trunk]: src/sys/arch/x86/pci we cannot guarantee that m_pulldown doesn't...

[maya <maya%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6661ed1aed4a
branches:  trunk
changeset: 350394:6661ed1aed4a
user:      maya <maya%NetBSD.org@localhost>
date:      Wed Jan 11 00:55:57 2017 +0000

description:
we cannot guarantee that m_pulldown doesn't fail, as it may fail even
if temporarily out of memory, and it will free the mbuf in this scenario.

test for failure and return error if it happens.

CID 1396651

ok riastradh

diffstat:

 sys/arch/x86/pci/if_vmx.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r a41625d1499b -r 6661ed1aed4a sys/arch/x86/pci/if_vmx.c
--- a/sys/arch/x86/pci/if_vmx.c Wed Jan 11 00:51:22 2017 +0000
+++ b/sys/arch/x86/pci/if_vmx.c Wed Jan 11 00:55:57 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_vmx.c,v 1.17 2017/01/11 00:51:22 maya Exp $ */
+/*     $NetBSD: if_vmx.c,v 1.18 2017/01/11 00:55:57 maya Exp $ */
 /*     $OpenBSD: if_vmx.c,v 1.16 2014/01/22 06:04:17 brad Exp $        */
 
 /*
@@ -19,7 +19,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_vmx.c,v 1.17 2017/01/11 00:51:22 maya Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_vmx.c,v 1.18 2017/01/11 00:55:57 maya Exp $");
 
 #include <sys/param.h>
 #include <sys/cpu.h>
@@ -2554,6 +2554,10 @@
 
        *csum_start = *start + csum_off;
        mp = m_pulldown(m, 0, *csum_start + 2, &offp);
+       if (!mp) {
+               /* m is already freed */
+               return ENOBUFS;
+       }
 
        if (m->m_pkthdr.csum_flags & (M_CSUM_TSOv4 | M_CSUM_TSOv6)) {
                struct tcphdr *tcp;