fixed a kernel crash due to a double-free introduced in the below fix

kame · Mar 22, 2006 · 7763d8c · 7763d8c
1 parent d7be582
commit 7763d8c
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -1,7 +1,11 @@
 			CHANGELOG for KAME kit
-$KAME: CHANGELOG,v 1.2820 2006/03/17 07:23:30 suz Exp $
+$KAME: CHANGELOG,v 1.2821 2006/03/22 18:48:46 suz Exp $
 
 <200603>
+2006-03-22  SUZUKI, Shinsuke <suz@alaxala.net>
+	* kame/sys/netinet6/nd6.c: fixed a kernel crash due to a double-free
+	introduced in the below fix
+
 2006-03-17  SUZUKI, Shinsuke <suz@alaxala.net>
 	* kame/sys/netinet6/nd6.c: fixed a memory leak for an unresolved
 	packet in ND queue

diff --git a/kame/sys/netinet6/nd6.c b/kame/sys/netinet6/nd6.c
@@ -1,4 +1,4 @@
-/*	$KAME: nd6.c,v 1.396 2006/03/17 07:23:31 suz Exp $	*/
+/*	$KAME: nd6.c,v 1.397 2006/03/22 18:48:46 suz Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -602,12 +602,18 @@ nd6_llinfo_timer(arg)
 		} else {
 			struct mbuf *m = ln->ln_hold;
 			if (m) {
+				struct mbuf *m0;
+
 				/*
 				 * assuming every packet in ln_hold has the
 				 * same IP header
 				 */
+				m0 = m->m_nextpkt;
+				m->m_nextpkt = NULL;
 				icmp6_error2(m, ICMP6_DST_UNREACH,
 				    ICMP6_DST_UNREACH_ADDR, 0, rt->rt_ifp);
+
+				ln->ln_hold = m0;
 				clear_llinfo_pqueue(ln);
 			}
 			if (rt)