⬢ DragonFlyBSD Kernel Audit
DF-3514 / fix.diff
← back to finding ↓ download raw
--- a/sys/netgraph7/netgraph/ng_base.c
+++ b/sys/netgraph7/netgraph/ng_base.c
@@ -953,9 +953,7 @@
 
 	for (i = 0; i <= ng_name_hmask; i++) {
 		LIST_FOREACH_MUTABLE(node, &ng_name_hash[i], nd_nodes, node2) {
-#ifdef INVARIANTS
 			LIST_REMOVE(node, nd_nodes);
-#endif
 			hash = hash32_str(NG_NODE_NAME(node), HASHINIT) & hmask;
 			LIST_INSERT_HEAD(&new[hash], node, nd_nodes);
 		}
@@ -985,15 +983,13 @@
 
 	for (i = 0; i <= ng_ID_hmask; i++) {
 		LIST_FOREACH_MUTABLE(node, &ng_ID_hash[i], nd_idnodes, node2) {
-#ifdef INVARIANTS
 			LIST_REMOVE(node, nd_idnodes);
-#endif
 			hash = (node->nd_ID % (hmask + 1));
 			LIST_INSERT_HEAD(&new[hash], node, nd_idnodes);
 		}
 	}
 
-	hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_name_hmask);
+	hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_ID_hmask);
 	ng_ID_hash = new;
 	ng_ID_hmask = hmask;
 }
@@ -3265,6 +3261,8 @@
 	NGI_ARG2(item) = arg2;
 	oitem = callout_arg(c);
 	callout_reset(c, ticks, &ng_callout_trampoline, item);
+	if (oitem != NULL && oitem != item)
+		ng_free_item(oitem);
 	return (0);
 }
 
@@ -3284,11 +3282,12 @@
 	if ((rval > 0) && (callout_func(c) == &ng_callout_trampoline) &&
 	    (NGI_NODE(item) == node)) {
 		/*
-		 * We successfully removed it from the queue before it ran
-		 * So now we need to unreference everything that was
-		 * given extra references. (NG_FREE_ITEM does this).
+		 * We successfully removed it from the queue before it ran.
+		 * The item was never sent, so its refcount is zero; free it
+		 * directly (this also drops the node/hook references it
+		 * holds).
 		 */
-		NG_FREE_ITEM(item);
+		ng_free_item(item);
 	}
 	callout_set_arg(c, NULL);