⬢ DragonFlyBSD Kernel Audit
DF-0669 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
diff --git a/sys/net/ipfw3_basic/ip_fw3_table.c b/sys/net/ipfw3_basic/ip_fw3_table.c
index 395ba09..d2d9b0f 100644
--- a/sys/net/ipfw3_basic/ip_fw3_table.c
+++ b/sys/net/ipfw3_basic/ip_fw3_table.c
@@ -127,8 +127,10 @@
 	table_ctx += ioc_tbl->id;
 	table_ctx->count = 0;
 
-	rn_flush(table_ctx->node, flush_table_entry);
-	/* XXX: should free the tree: rn_freehead(table_ctx->node) */
+	if (table_ctx->node != NULL) {
+		rn_flush(table_ctx->node, flush_table_entry);
+		/* XXX: should free the tree: rn_freehead(table_ctx->node) */
+	}
 	table_ctx->type = 0;
 	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
 }
@@ -245,7 +247,8 @@
 	rnh = table_ctx->node;
 	table_ctx->count = 0;
 
-	rn_flush(rnh, flush_table_entry);
+	if (rnh != NULL)
+		rn_flush(rnh, flush_table_entry);
 	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
 }
 
@@ -580,7 +583,8 @@
 	table_ctx = fw3_ctx[mycpuid]->table_ctx;
 	tmp_table = table_ctx;
 	for (id = 0; id < IPFW_TABLES_MAX; id++, table_ctx++) {
-		rn_flush(table_ctx->node, flush_table_entry);
+		if (table_ctx->node != NULL)
+			rn_flush(table_ctx->node, flush_table_entry);
 		/* XXX: should free the tree: rn_freehead(table_ctx->node) */
 	}
 	kfree(tmp_table, M_IPFW3_TABLE);