DragonFlyBSD Kernel Audit
DF-2905 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/libmchain/subr_mchain.c
+++ b/sys/kern/libmchain/subr_mchain.c
@@ -323,10 +323,14 @@
 void
 md_done(struct mdchain *mdp)
 {
-	if (mdp->md_top) {
-		m_freem(mdp->md_top);
-		mdp->md_top = NULL;
+	struct mbuf *m = mdp->md_top, *next;
+
+	while (m) {
+		next = m->m_nextpkt;
+		m_freem(m);
+		m = next;
 	}
+	mdp->md_top = mdp->md_cur = NULL;
 }
 
 /*
@@ -361,6 +365,7 @@
 	if (mdp->md_top == NULL)
 		return ENOENT;
 	m = mdp->md_top->m_nextpkt;
+	mdp->md_top->m_nextpkt = NULL;	/* detach the record being retired */
 	md_done(mdp);
 	if (m == NULL)
 		return ENOENT;