diff options
| author | David Gwynne <dlg@cvs.openbsd.org> | 2015-07-24 01:19:19 +0000 |
|---|---|---|
| committer | David Gwynne <dlg@cvs.openbsd.org> | 2015-07-24 01:19:19 +0000 |
| commit | d1ed6ca774d7d2da694b08d0250cc2eb1f35e427 (patch) | |
| tree | d064d4ced9c759e26dc1924eaf1005b10a8edf85 /sys | |
| parent | 1de2d099333b381454678c7d966a46164d7578cf (diff) | |
if we free the mbuf in the rx path, clear the pointer to it so we dont
try and queue it for the stack and cause a use after free.
found by maxime villard and brainy
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/pci/if_bnx.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/dev/pci/if_bnx.c b/sys/dev/pci/if_bnx.c index 9d1249ea436..ec17fc86769 100644 --- a/sys/dev/pci/if_bnx.c +++ b/sys/dev/pci/if_bnx.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bnx.c,v 1.111 2015/06/24 09:40:54 mpi Exp $ */ +/* $OpenBSD: if_bnx.c,v 1.112 2015/07/24 01:19:18 dlg Exp $ */ /*- * Copyright (c) 2006 Broadcom Corporation @@ -4474,6 +4474,7 @@ bnx_rx_intr(struct bnx_softc *sc) m->m_flags |= M_VLANTAG; #else m_freem(m); + m = NULL; goto bnx_rx_int_next_rx; #endif } |