From nobody@FreeBSD.org  Fri Sep 14 22:18:49 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id AD7EC16A417
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 14 Sep 2007 22:18:49 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 8162013C45B
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 14 Sep 2007 22:18:49 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.1/8.14.1) with ESMTP id l8EMInLf042743
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 14 Sep 2007 22:18:49 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.1/8.14.1/Submit) id l8EMInjP042742;
	Fri, 14 Sep 2007 22:18:49 GMT
	(envelope-from nobody)
Message-Id: <200709142218.l8EMInjP042742@www.freebsd.org>
Date: Fri, 14 Sep 2007 22:18:49 GMT
From: Peter Hunt <peter.hunt@nokia.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Potential double-free on error when copying IPv6 output options.
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         116360
>Category:       kern
>Synopsis:       Potential double-free on error when copying IPv6 output options.
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    mtm
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 14 22:20:01 GMT 2007
>Closed-Date:    Sat Jan 26 07:16:52 UTC 2008
>Last-Modified:  Sat Jan 26 07:16:52 UTC 2008
>Originator:     Peter Hunt
>Release:        FreeBSD 6.1 RELEASE
>Organization:
Nokia
>Environment:
FreeBSD frente.nes.nokia.com 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Sun May  7 04:42:56 UTC 2006     root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP  i386
>Description:
I noticed what I think is a double free problem by code inspection. It appears to be in 6.1 (which I'm using) and HEAD. I have not seen any problem during use.

In ip6_output.c:copypktopts(), if an error occurs while copying the packet options from src to dst, the routine frees all the fields in dst, but does not set them to NULL. It then returns error status.

Some callers of copypktopts() (via in6_setpktopts()) handle the error by calling in6_clearpktopts() on dst, which will try to free the fields again, as they are not NULL.

Specifically, raw_ip6.c:rip6_output() and udp_usrreq.c:udp6_output() both call ip6_setpktopts, passing src and dst pktopts pointers, and handle the error by calling in6_clearpktopts.

Regards,

Peter Hunt
Nokia Enterprise Solutions

>How-To-Repeat:

>Fix:
I think this problem can be solved by having clearpktopts() zero out the fields after freeing them (or calling ip6_initpktopts on dst).


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->analyzed 
State-Changed-By: mtm 
State-Changed-When: Tue Nov 20 23:14:35 UTC 2007 
State-Changed-Why:  
I have a patch for this. 


Responsible-Changed-From-To: freebsd-bugs->mtm 
Responsible-Changed-By: mtm 
Responsible-Changed-When: Tue Nov 20 23:14:35 UTC 2007 
Responsible-Changed-Why:  
I have a patch for this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=116360 

From: Mike Makonnen <mtm@FreeBSD.Org>
To: "peter.hunt" <peter.hunt@nokia.com>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/116360: Potential double-free on error when copying IPv6
	output options.
Date: Wed, 21 Nov 2007 02:35:12 +0300

 --=-5vHMJbK4wLy/R2+z+1U1
 Content-Type: text/plain
 Content-Transfer-Encoding: 7bit
 
 The attached patch should take care of this.
 
 Cheers.
 -- 
 Mike Makonnen         | GPG-KEY: http://people.freebsd.org/~mtm/mtm.asc
 mmakonnen @ gmail.com | AC7B 5672 2D11 F4D0 EBF8 5279 5359 2B82 7CD4 1F55
 mtm @ FreeBSD.Org     | FreeBSD - http://www.freebsd.org
 
 --=-5vHMJbK4wLy/R2+z+1U1
 Content-Disposition: attachment; filename=ip6-doublefree-01.patch
 Content-Type: text/x-patch; name=ip6-doublefree-01.patch; charset=us-ascii
 Content-Transfer-Encoding: base64
 
 SW5kZXg6IHN5cy9uZXRpbmV0Ni9pcDZfb3V0cHV0LmMNCj09PT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NClJDUyBmaWxlOiAv
 aG9tZS9uY3ZzL3NyYy9zeXMvbmV0aW5ldDYvaXA2X291dHB1dC5jLHYNCnJldHJpZXZpbmcgcmV2
 aXNpb24gMS4xMDkNCmRpZmYgLXUgLXIxLjEwOSBpcDZfb3V0cHV0LmMNCi0tLSBzeXMvbmV0aW5l
 dDYvaXA2X291dHB1dC5jCTUgSnVsIDIwMDcgMTY6Mjk6NDAgLTAwMDAJMS4xMDkNCisrKyBzeXMv
 bmV0aW5ldDYvaXA2X291dHB1dC5jCTEwIE5vdiAyMDA3IDA4OjAyOjUyIC0wMDAwDQpAQCAtMjEz
 MCw3ICsyMTMwLDYgQEANCiAJCXByaXYgPSAxOw0KIAlpZiAoKGVycm9yID0gaXA2X3NldHBrdG9w
 dHMobSwgb3B0LCBOVUxMLCBwcml2LA0KIAkgICAgc28tPnNvX3Byb3RvLT5wcl9wcm90b2NvbCkp
 ICE9IDApIHsNCi0JCWlwNl9jbGVhcnBrdG9wdHMob3B0LCAtMSk7IC8qIFhYWDogZGlzY2FyZCBh
 bGwgb3B0aW9ucyAqLw0KIAkJZnJlZShvcHQsIE1fSVA2T1BUKTsNCiAJCXJldHVybiAoZXJyb3Ip
 Ow0KIAl9DQpAQCAtMjM2MSwxMiArMjM2MCw3IEBADQogCXJldHVybiAoMCk7DQogDQogICBiYWQ6
 DQotCWlmIChkc3QtPmlwNnBvX3BrdGluZm8pIGZyZWUoZHN0LT5pcDZwb19wa3RpbmZvLCBNX0lQ
 Nk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX25leHRob3ApIGZyZWUoZHN0LT5pcDZwb19uZXh0aG9w
 LCBNX0lQNk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX2hiaCkgZnJlZShkc3QtPmlwNnBvX2hiaCwg
 TV9JUDZPUFQpOw0KLQlpZiAoZHN0LT5pcDZwb19kZXN0MSkgZnJlZShkc3QtPmlwNnBvX2Rlc3Qx
 LCBNX0lQNk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX2Rlc3QyKSBmcmVlKGRzdC0+aXA2cG9fZGVz
 dDIsIE1fSVA2T1BUKTsNCi0JaWYgKGRzdC0+aXA2cG9fcnRoZHIpIGZyZWUoZHN0LT5pcDZwb19y
 dGhkciwgTV9JUDZPUFQpOw0KKwlpcDZfY2xlYXJwa3RvcHRzKGRzdCwgLTEpOw0KIAlyZXR1cm4g
 KEVOT0JVRlMpOw0KIH0NCiAjdW5kZWYgUEtUT1BUX0VYVEhEUkNQWQ0KQEAgLTI3NzUsMTMgKzI3
 NjksMTQgQEANCiAgICAgc3RydWN0IGlwNl9wa3RvcHRzICpzdGlja3lvcHQsIGludCBwcml2LCBp
 bnQgdXByb3RvKQ0KIHsNCiAJc3RydWN0IGNtc2doZHIgKmNtID0gMDsNCisJaW50IGVycm9yOw0K
 IA0KIAlpZiAoY29udHJvbCA9PSBOVUxMIHx8IG9wdCA9PSBOVUxMKQ0KIAkJcmV0dXJuIChFSU5W
 QUwpOw0KIA0KKwllcnJvciA9IDA7DQogCWlwNl9pbml0cGt0b3B0cyhvcHQpOw0KIAlpZiAoc3Rp
 Y2t5b3B0KSB7DQotCQlpbnQgZXJyb3I7DQogDQogCQkvKg0KIAkJICogSWYgc3RpY2t5b3B0IGlz
 IHByb3ZpZGVkLCBtYWtlIGEgbG9jYWwgY29weSBvZiB0aGUgb3B0aW9ucw0KQEAgLTI3OTMsMzYg
 KzI3ODgsNDQgQEANCiAJCSAqIHVzZWQuDQogCQkgKi8NCiAJCWlmICgoZXJyb3IgPSBjb3B5cGt0
 b3B0cyhvcHQsIHN0aWNreW9wdCwgTV9OT1dBSVQpKSAhPSAwKQ0KLQkJCXJldHVybiAoZXJyb3Ip
 Ow0KKwkJCWdvdG8gb3V0Ow0KIAl9DQogDQogCS8qDQogCSAqIFhYWDogQ3VycmVudGx5LCB3ZSBh
 c3N1bWUgYWxsIHRoZSBvcHRpb25hbCBpbmZvcm1hdGlvbiBpcyBzdG9yZWQNCiAJICogaW4gYSBz
 aW5nbGUgbWJ1Zi4NCiAJICovDQotCWlmIChjb250cm9sLT5tX25leHQpDQotCQlyZXR1cm4gKEVJ
 TlZBTCk7DQorCWlmIChjb250cm9sLT5tX25leHQpIHsNCisJCWVycm9yID0gRUlOVkFMOw0KKwkJ
 Z290byBvdXQ7DQorCX0NCiANCiAJZm9yICg7IGNvbnRyb2wtPm1fbGVuOyBjb250cm9sLT5tX2Rh
 dGEgKz0gQ01TR19BTElHTihjbS0+Y21zZ19sZW4pLA0KIAkgICAgY29udHJvbC0+bV9sZW4gLT0g
 Q01TR19BTElHTihjbS0+Y21zZ19sZW4pKSB7DQotCQlpbnQgZXJyb3I7DQogDQotCQlpZiAoY29u
 dHJvbC0+bV9sZW4gPCBDTVNHX0xFTigwKSkNCi0JCQlyZXR1cm4gKEVJTlZBTCk7DQorCQlpZiAo
 Y29udHJvbC0+bV9sZW4gPCBDTVNHX0xFTigwKSkgew0KKwkJCWVycm9yID0gRUlOVkFMOw0KKwkJ
 CWdvdG8gb3V0Ow0KKwkJfQ0KIA0KIAkJY20gPSBtdG9kKGNvbnRyb2wsIHN0cnVjdCBjbXNnaGRy
 ICopOw0KLQkJaWYgKGNtLT5jbXNnX2xlbiA9PSAwIHx8IGNtLT5jbXNnX2xlbiA+IGNvbnRyb2wt
 Pm1fbGVuKQ0KLQkJCXJldHVybiAoRUlOVkFMKTsNCisJCWlmIChjbS0+Y21zZ19sZW4gPT0gMCB8
 fCBjbS0+Y21zZ19sZW4gPiBjb250cm9sLT5tX2xlbikgew0KKwkJCWVycm9yID0gRUlOVkFMOw0K
 KwkJCWdvdG8gb3V0Ow0KKwkJfQ0KIAkJaWYgKGNtLT5jbXNnX2xldmVsICE9IElQUFJPVE9fSVBW
 NikNCiAJCQljb250aW51ZTsNCiANCiAJCWVycm9yID0gaXA2X3NldHBrdG9wdChjbS0+Y21zZ190
 eXBlLCBDTVNHX0RBVEEoY20pLA0KIAkJICAgIGNtLT5jbXNnX2xlbiAtIENNU0dfTEVOKDApLCBv
 cHQsIHByaXYsIDAsIDEsIHVwcm90byk7DQogCQlpZiAoZXJyb3IpDQotCQkJcmV0dXJuIChlcnJv
 cik7DQorCQkJZ290byBvdXQ7DQogCX0NCiANCi0JcmV0dXJuICgwKTsNCitvdXQ6DQorCWlmIChl
 cnJvciAhPSAwKQ0KKwkJaXA2X2NsZWFycGt0b3B0cyhvcHQsIC0xKTsNCisJcmV0dXJuIChlcnJv
 cik7DQogfQ0KIA0KIC8qDQo=
 
 
 --=-5vHMJbK4wLy/R2+z+1U1--

From: Mike Makonnen <mtm@FreeBSD.Org>
To: "peter.hunt" <peter.hunt@nokia.com>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/116360: Potential double-free on error when copying IPv6
	output options.
Date: Wed, 21 Nov 2007 03:12:58 +0300

 --=-HC6OerZPIL1h7XpoUl3H
 Content-Type: text/plain
 Content-Transfer-Encoding: 7bit
 
 Hmm, let's try this again.
 
 -- 
 Mike Makonnen         | GPG-KEY: http://people.freebsd.org/~mtm/mtm.asc
 mmakonnen @ gmail.com | AC7B 5672 2D11 F4D0 EBF8 5279 5359 2B82 7CD4 1F55
 mtm @ FreeBSD.Org     | FreeBSD - http://www.freebsd.org
 
 --=-HC6OerZPIL1h7XpoUl3H
 Content-Disposition: attachment; filename=ip6-doublefree-01.diff
 Content-Transfer-Encoding: base64
 Content-Type: text/x-patch; name=ip6-doublefree-01.diff; charset=us-ascii
 
 SW5kZXg6IHN5cy9uZXRpbmV0Ni9pcDZfb3V0cHV0LmMNCj09PT09PT09PT09PT09PT09PT09PT09
 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NClJDUyBmaWxlOiAv
 aG9tZS9uY3ZzL3NyYy9zeXMvbmV0aW5ldDYvaXA2X291dHB1dC5jLHYNCnJldHJpZXZpbmcgcmV2
 aXNpb24gMS4xMDkNCmRpZmYgLXUgLXIxLjEwOSBpcDZfb3V0cHV0LmMNCi0tLSBzeXMvbmV0aW5l
 dDYvaXA2X291dHB1dC5jCTUgSnVsIDIwMDcgMTY6Mjk6NDAgLTAwMDAJMS4xMDkNCisrKyBzeXMv
 bmV0aW5ldDYvaXA2X291dHB1dC5jCTEwIE5vdiAyMDA3IDA4OjAyOjUyIC0wMDAwDQpAQCAtMjEz
 MCw3ICsyMTMwLDYgQEANCiAJCXByaXYgPSAxOw0KIAlpZiAoKGVycm9yID0gaXA2X3NldHBrdG9w
 dHMobSwgb3B0LCBOVUxMLCBwcml2LA0KIAkgICAgc28tPnNvX3Byb3RvLT5wcl9wcm90b2NvbCkp
 ICE9IDApIHsNCi0JCWlwNl9jbGVhcnBrdG9wdHMob3B0LCAtMSk7IC8qIFhYWDogZGlzY2FyZCBh
 bGwgb3B0aW9ucyAqLw0KIAkJZnJlZShvcHQsIE1fSVA2T1BUKTsNCiAJCXJldHVybiAoZXJyb3Ip
 Ow0KIAl9DQpAQCAtMjM2MSwxMiArMjM2MCw3IEBADQogCXJldHVybiAoMCk7DQogDQogICBiYWQ6
 DQotCWlmIChkc3QtPmlwNnBvX3BrdGluZm8pIGZyZWUoZHN0LT5pcDZwb19wa3RpbmZvLCBNX0lQ
 Nk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX25leHRob3ApIGZyZWUoZHN0LT5pcDZwb19uZXh0aG9w
 LCBNX0lQNk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX2hiaCkgZnJlZShkc3QtPmlwNnBvX2hiaCwg
 TV9JUDZPUFQpOw0KLQlpZiAoZHN0LT5pcDZwb19kZXN0MSkgZnJlZShkc3QtPmlwNnBvX2Rlc3Qx
 LCBNX0lQNk9QVCk7DQotCWlmIChkc3QtPmlwNnBvX2Rlc3QyKSBmcmVlKGRzdC0+aXA2cG9fZGVz
 dDIsIE1fSVA2T1BUKTsNCi0JaWYgKGRzdC0+aXA2cG9fcnRoZHIpIGZyZWUoZHN0LT5pcDZwb19y
 dGhkciwgTV9JUDZPUFQpOw0KKwlpcDZfY2xlYXJwa3RvcHRzKGRzdCwgLTEpOw0KIAlyZXR1cm4g
 KEVOT0JVRlMpOw0KIH0NCiAjdW5kZWYgUEtUT1BUX0VYVEhEUkNQWQ0KQEAgLTI3NzUsMTMgKzI3
 NjksMTQgQEANCiAgICAgc3RydWN0IGlwNl9wa3RvcHRzICpzdGlja3lvcHQsIGludCBwcml2LCBp
 bnQgdXByb3RvKQ0KIHsNCiAJc3RydWN0IGNtc2doZHIgKmNtID0gMDsNCisJaW50IGVycm9yOw0K
 IA0KIAlpZiAoY29udHJvbCA9PSBOVUxMIHx8IG9wdCA9PSBOVUxMKQ0KIAkJcmV0dXJuIChFSU5W
 QUwpOw0KIA0KKwllcnJvciA9IDA7DQogCWlwNl9pbml0cGt0b3B0cyhvcHQpOw0KIAlpZiAoc3Rp
 Y2t5b3B0KSB7DQotCQlpbnQgZXJyb3I7DQogDQogCQkvKg0KIAkJICogSWYgc3RpY2t5b3B0IGlz
 IHByb3ZpZGVkLCBtYWtlIGEgbG9jYWwgY29weSBvZiB0aGUgb3B0aW9ucw0KQEAgLTI3OTMsMzYg
 KzI3ODgsNDQgQEANCiAJCSAqIHVzZWQuDQogCQkgKi8NCiAJCWlmICgoZXJyb3IgPSBjb3B5cGt0
 b3B0cyhvcHQsIHN0aWNreW9wdCwgTV9OT1dBSVQpKSAhPSAwKQ0KLQkJCXJldHVybiAoZXJyb3Ip
 Ow0KKwkJCWdvdG8gb3V0Ow0KIAl9DQogDQogCS8qDQogCSAqIFhYWDogQ3VycmVudGx5LCB3ZSBh
 c3N1bWUgYWxsIHRoZSBvcHRpb25hbCBpbmZvcm1hdGlvbiBpcyBzdG9yZWQNCiAJICogaW4gYSBz
 aW5nbGUgbWJ1Zi4NCiAJICovDQotCWlmIChjb250cm9sLT5tX25leHQpDQotCQlyZXR1cm4gKEVJ
 TlZBTCk7DQorCWlmIChjb250cm9sLT5tX25leHQpIHsNCisJCWVycm9yID0gRUlOVkFMOw0KKwkJ
 Z290byBvdXQ7DQorCX0NCiANCiAJZm9yICg7IGNvbnRyb2wtPm1fbGVuOyBjb250cm9sLT5tX2Rh
 dGEgKz0gQ01TR19BTElHTihjbS0+Y21zZ19sZW4pLA0KIAkgICAgY29udHJvbC0+bV9sZW4gLT0g
 Q01TR19BTElHTihjbS0+Y21zZ19sZW4pKSB7DQotCQlpbnQgZXJyb3I7DQogDQotCQlpZiAoY29u
 dHJvbC0+bV9sZW4gPCBDTVNHX0xFTigwKSkNCi0JCQlyZXR1cm4gKEVJTlZBTCk7DQorCQlpZiAo
 Y29udHJvbC0+bV9sZW4gPCBDTVNHX0xFTigwKSkgew0KKwkJCWVycm9yID0gRUlOVkFMOw0KKwkJ
 CWdvdG8gb3V0Ow0KKwkJfQ0KIA0KIAkJY20gPSBtdG9kKGNvbnRyb2wsIHN0cnVjdCBjbXNnaGRy
 ICopOw0KLQkJaWYgKGNtLT5jbXNnX2xlbiA9PSAwIHx8IGNtLT5jbXNnX2xlbiA+IGNvbnRyb2wt
 Pm1fbGVuKQ0KLQkJCXJldHVybiAoRUlOVkFMKTsNCisJCWlmIChjbS0+Y21zZ19sZW4gPT0gMCB8
 fCBjbS0+Y21zZ19sZW4gPiBjb250cm9sLT5tX2xlbikgew0KKwkJCWVycm9yID0gRUlOVkFMOw0K
 KwkJCWdvdG8gb3V0Ow0KKwkJfQ0KIAkJaWYgKGNtLT5jbXNnX2xldmVsICE9IElQUFJPVE9fSVBW
 NikNCiAJCQljb250aW51ZTsNCiANCiAJCWVycm9yID0gaXA2X3NldHBrdG9wdChjbS0+Y21zZ190
 eXBlLCBDTVNHX0RBVEEoY20pLA0KIAkJICAgIGNtLT5jbXNnX2xlbiAtIENNU0dfTEVOKDApLCBv
 cHQsIHByaXYsIDAsIDEsIHVwcm90byk7DQogCQlpZiAoZXJyb3IpDQotCQkJcmV0dXJuIChlcnJv
 cik7DQorCQkJZ290byBvdXQ7DQogCX0NCiANCi0JcmV0dXJuICgwKTsNCitvdXQ6DQorCWlmIChl
 cnJvciAhPSAwKQ0KKwkJaXA2X2NsZWFycGt0b3B0cyhvcHQsIC0xKTsNCisJcmV0dXJuIChlcnJv
 cik7DQogfQ0KIA0KIC8qDQo=
 
 
 --=-HC6OerZPIL1h7XpoUl3H--

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/116360: commit references a PR
Date: Wed, 21 Nov 2007 16:01:46 +0000 (UTC)

 mtm         2007-11-21 16:01:42 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/netinet6         ip6_output.c 
   Log:
   Instead of manually freeing the packet options structure (and not even doing
   a good job of it) in the copypktopts() function, just call ip6_clearpktopts()
   directly. Otherwise, the callers of this function would end up freeing the
   memory twice.
   
   Reviewed by: jinmei
   PR:          kern/116360
   
   Revision  Changes    Path
   1.110     +1 -6      src/sys/netinet6/ip6_output.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: analyzed->patched 
State-Changed-By: mtm 
State-Changed-When: Wed Nov 21 16:17:00 UTC 2007 
State-Changed-Why:  
I'll MFC this in about a week. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=116360 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/116360: commit references a PR
Date: Sat, 26 Jan 2008 06:49:38 +0000 (UTC)

 mtm         2008-01-26 06:49:27 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_7)
     sys/netinet6         ip6_output.c 
   Log:
   MFC: rev. 1.110
   ----------------------------------------------------------------------------
   Instead of manually freeing the packet options structure (and not even doing
   a good job of it) in the copypktopts() function, just call ip6_clearpktopts()
   directly. Otherwise, the callers of this function would end up freeing the
   memory twice.
   
   Reviewed by: jinmei
   PR:          kern/116360
   ----------------------------------------------------------------------------
   
   Revision   Changes    Path
   1.109.2.1  +1 -6      src/sys/netinet6/ip6_output.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/116360: commit references a PR
Date: Sat, 26 Jan 2008 07:08:54 +0000 (UTC)

 mtm         2008-01-26 07:08:48 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sys/netinet6         ip6_output.c 
   Log:
   MFC: rev. 1.110
   ----------------------------------------------------------------------------
   Instead of manually freeing the packet options structure (and not even doing
   a good job of it) in the copypktopts() function, just call ip6_clearpktopts()
   directly. Otherwise, the callers of this function would end up freeing the
   memory twice.
   
   Reviewed by: jinmei
   PR:          kern/116360
   ----------------------------------------------------------------------------
   
   Revision   Changes    Path
   1.90.2.11  +1 -6      src/sys/netinet6/ip6_output.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: mtm 
State-Changed-When: Sat Jan 26 07:14:37 UTC 2008 
State-Changed-Why:  
patched and MFCed to RELENG_7 and RELENG_6 

http://www.freebsd.org/cgi/query-pr.cgi?pr=116360 
>Unformatted:
