5976 e1000g use after free on start failure

Reviewed by: Robert Mustacchi <rm@joyent.com> Reviewed by: Marcel Telka <marcel.telka@nexenta.com> Reviewed by: Hans Rosenfeld <hans.rosenfeld@nexenta.com> Reviewed by: Kevin Crowe <kevin.crowe@nexenta.com> Approved by: Dan McDonald <danmcd@omniti.com>
illumos · Jun 4, 2015 · bcfab05 · bcfab05
1 parent 8370701
commit bcfab05
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/usr/src/uts/common/io/e1000g/e1000g_alloc.c b/usr/src/uts/common/io/e1000g/e1000g_alloc.c
@@ -1455,6 +1455,9 @@ e1000g_free_rx_packets(e1000g_rx_data_t *rx_data, boolean_t full_release)
 		packet = next_packet;
 	}
 
+	if (full_release)
+		rx_data->packet_area = NULL;
+
 	mutex_exit(&e1000g_rx_detach_lock);
 }