[src/netbsd-7]: src/sys/dev/pci Pull up following revision(s) (requested by m...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/3b2d0e7f217f
branches:  netbsd-7
changeset: 799539:3b2d0e7f217f
user:      snj <snj%NetBSD.org@localhost>
date:      Tue Aug 04 21:16:43 2015 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #914):
        sys/dev/pci/if_et.c: revision 1.9
Use-after-free.
ok christos@
Found by Brainy.

diffstat:

 sys/dev/pci/if_et.c |  6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

diffs (34 lines):

diff -r 82a3dae937cc -r 3b2d0e7f217f sys/dev/pci/if_et.c
--- a/sys/dev/pci/if_et.c       Tue Aug 04 21:14:49 2015 +0000
+++ b/sys/dev/pci/if_et.c       Tue Aug 04 21:16:43 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $       */
+/*     $NetBSD: if_et.c,v 1.8.4.1 2015/08/04 21:16:43 snj Exp $        */
 /*     $OpenBSD: if_et.c,v 1.11 2008/06/08 06:18:07 jsg Exp $  */
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.8 2014/03/29 19:28:24 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_et.c,v 1.8.4.1 2015/08/04 21:16:43 snj Exp $");
 
 #include "opt_inet.h"
 #include "vlan.h"
@@ -1823,7 +1823,6 @@
 
                MGETHDR(m_new, M_DONTWAIT, MT_DATA);
                if (m_new == NULL) {
-                       m_freem(m);
                        aprint_error_dev(sc->sc_dev, "can't defrag TX mbuf\n");
                        error = ENOBUFS;
                        goto back;
@@ -1833,7 +1832,6 @@
                if (m->m_pkthdr.len > MHLEN) {
                        MCLGET(m_new, M_DONTWAIT);
                        if (!(m_new->m_flags & M_EXT)) {
-                               m_freem(m);
                                m_freem(m_new);
                                error = ENOBUFS;
                        }