[src/trunk]: src/sys/dev/marvell Fix double-free, m_tag_delete_chain is alrea...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5ec2e1fc7c9a
branches:  trunk
changeset: 322555:5ec2e1fc7c9a
user:      maxv <maxv%NetBSD.org@localhost>
date:      Mon May 07 09:41:10 2018 +0000

description:
Fix double-free, m_tag_delete_chain is already called by m_free.

diffstat:

 sys/dev/marvell/mvxpbm.c |  7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diffs (28 lines):

diff -r 35fd14f08f70 -r 5ec2e1fc7c9a sys/dev/marvell/mvxpbm.c
--- a/sys/dev/marvell/mvxpbm.c  Mon May 07 09:33:51 2018 +0000
+++ b/sys/dev/marvell/mvxpbm.c  Mon May 07 09:41:10 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: mvxpbm.c,v 1.1 2015/06/03 03:55:47 hsuenaga Exp $      */
+/*     $NetBSD: mvxpbm.c,v 1.2 2018/05/07 09:41:10 maxv Exp $  */
 /*
  * Copyright (c) 2015 Internet Initiative Japan Inc.
  * All rights reserved.
@@ -25,7 +25,7 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mvxpbm.c,v 1.1 2015/06/03 03:55:47 hsuenaga Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mvxpbm.c,v 1.2 2018/05/07 09:41:10 maxv Exp $");
 
 #include "opt_multiprocessor.h"
 
@@ -322,8 +322,7 @@
        KASSERT(arg != NULL);
 
        DPRINTFN(3, "free packet %p\n", m);
-       if (m->m_flags & M_PKTHDR)
-               m_tag_delete_chain((m), NULL);
+
        chunk->m = NULL;
        s = splvm();
        pool_cache_put(mb_cache, m);