fixed a memory leak in unresolved ND queue processing. (Reported by H…

…ikaru Abe)
kame · May 4, 2007 · 6484505 · 6484505
1 parent 7a346f7
commit 6484505
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 25 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,5 +1,10 @@
 			CHANGELOG for KAME kit
-$KAME: CHANGELOG,v 1.2836 2006/10/25 07:14:33 jinmei Exp $
+$KAME: CHANGELOG,v 1.2837 2007/05/04 01:43:28 suz Exp $
+
+<200705>
+2007-05-04  SUZUKI, Shinsuke <suz@kame.net>
+	* kame/sys/netinet6/{nd6.c, nd6_nbr.c}: fixed a memory leak in
+	unresolved ND queue processing. (Reported by Hikaru Abe)
 
 <200610>
 2006-10-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>

diff --git a/kame/sys/netinet6/nd6.c b/kame/sys/netinet6/nd6.c
@@ -1,4 +1,4 @@
-/*	$KAME: nd6.c,v 1.399 2006/04/23 02:51:26 jinmei Exp $	*/
+/*	$KAME: nd6.c,v 1.400 2007/05/04 01:43:28 suz Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -2147,24 +2147,17 @@ nd6_cache_lladdr(ifp, from, lladdr, lladdrlen, type, code)
 
 			if (ln->ln_hold) {
 				struct mbuf *m_hold, *m_hold_next;
-				for (m_hold = ln->ln_hold; m_hold;
+				for (m_hold = ln->ln_hold, ln->ln_hold = NULL;
-				     m_hold = m_hold_next) {
+				    m_hold; m_hold = m_hold_next) {
-					struct mbuf *mpkt = NULL;
-
 					m_hold_next = m_hold->m_nextpkt;
-					mpkt = m_copym(m_hold, 0, M_COPYALL, M_DONTWAIT);
+					m_hold->m_nextpkt = NULL;
-					if (mpkt == NULL) {
-						m_freem(m_hold);
-						break;
-					}
-					mpkt->m_nextpkt = NULL;
 
 					/*
 					 * we assume ifp is not a p2p here, so
 					 * just set the 2nd argument as the 
 					 * 1st one.
 					 */
-					nd6_output(ifp, ifp, mpkt,
+					nd6_output(ifp, ifp, m_hold,
 					     (struct sockaddr_in6 *)rt_key(rt),
 					     rt);
 				}

diff --git a/kame/sys/netinet6/nd6_nbr.c b/kame/sys/netinet6/nd6_nbr.c
@@ -1,4 +1,4 @@
-/*	$KAME: nd6_nbr.c,v 1.171 2006/05/14 10:25:01 jinmei Exp $	*/
+/*	$KAME: nd6_nbr.c,v 1.172 2007/05/04 01:43:28 suz Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -927,24 +927,17 @@ nd6_na_input(m, off, icmp6len)
 	if (ln->ln_hold) {
 		struct mbuf *m_hold, *m_hold_next;
 
-		for (m_hold = ln->ln_hold; m_hold; m_hold = m_hold_next) {
+		for (m_hold = ln->ln_hold, ln->ln_hold = NULL;
-			struct mbuf *mpkt = NULL;
+		    m_hold; m_hold = m_hold_next) {
-
 			m_hold_next = m_hold->m_nextpkt;
-			mpkt = m_copym(m_hold, 0, M_COPYALL, M_DONTWAIT);
+			m_hold->m_nextpkt = NULL;
-			if (mpkt == NULL) {
-				m_freem(m_hold);
-				break;
-			}
-			mpkt->m_nextpkt = NULL;
 			/*
 			 * we assume ifp is not a loopback here, so just set
 			 * the 2nd argument as the 1st one.
 			 */
-			nd6_output(ifp, ifp, mpkt,
+			nd6_output(ifp, ifp, m_hold,
 			    (struct sockaddr_in6 *)rt_key(rt), rt);
 		}
-		ln->ln_hold = NULL;
 	}
 
  freeit: