diff options
| author | anton <anton@cvs.openbsd.org> | 2018-07-04 02:08:14 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2018-07-04 02:08:14 +0000 |
| commit | 95daf738003fd0d16316fdab40ba5990bd4cb7a8 (patch) | |
| tree | c0c43d45e12b2163f8970b9d8bcbef99b9e584e8 /sys | |
| parent | 2283458dc0296b67d3f571e75cb0f18319d74cec (diff) | |
Prevent a mbuf double free by not freeing it along the error-path in
rip{6,}_usrreq() since soreceive() will free it.
ok bluhm@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/raw_ip.c | 8 | ||||
| -rw-r--r-- | sys/netinet6/raw_ip6.c | 8 |
2 files changed, 10 insertions, 6 deletions
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index 0bdbd5eb9ab..6e9ca1e197d 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -1,4 +1,4 @@ -/* $OpenBSD: raw_ip.c,v 1.109 2018/04/24 15:40:55 pirofti Exp $ */ +/* $OpenBSD: raw_ip.c,v 1.110 2018/07/04 02:08:13 anton Exp $ */ /* $NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $ */ /* @@ -482,14 +482,16 @@ rip_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam, /* * Not supported. */ - case PRU_RCVOOB: - case PRU_RCVD: case PRU_LISTEN: case PRU_ACCEPT: case PRU_SENDOOB: error = EOPNOTSUPP; break; + case PRU_RCVD: + case PRU_RCVOOB: + return (EOPNOTSUPP); /* do not free mbuf's */ + case PRU_SOCKADDR: in_setsockaddr(inp, nam); break; diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c index d75031fd090..e89c21e403c 100644 --- a/sys/netinet6/raw_ip6.c +++ b/sys/netinet6/raw_ip6.c @@ -1,4 +1,4 @@ -/* $OpenBSD: raw_ip6.c,v 1.127 2018/04/24 15:40:55 pirofti Exp $ */ +/* $OpenBSD: raw_ip6.c,v 1.128 2018/07/04 02:08:13 anton Exp $ */ /* $KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $ */ /* @@ -666,14 +666,16 @@ rip6_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam, /* * Not supported. */ - case PRU_RCVOOB: - case PRU_RCVD: case PRU_LISTEN: case PRU_ACCEPT: case PRU_SENDOOB: error = EOPNOTSUPP; break; + case PRU_RCVD: + case PRU_RCVOOB: + return (EOPNOTSUPP); /* do not free mbuf's */ + case PRU_SOCKADDR: in6_setsockaddr(in6p, nam); break; |