[src/trunk]: src/sys/net Not sure what we are trying to achieve here, but the...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d9652cf26448
branches:  trunk
changeset: 821333:d9652cf26448
user:      maxv <maxv%NetBSD.org@localhost>
date:      Wed Feb 01 17:58:47 2017 +0000

description:
Not sure what we are trying to achieve here, but there are two issues;
error can be printed while it is not initialized, and if m_pulldown fails
m is freed and reused.

Quickly reviewed by christos and martin

diffstat:

 sys/net/if_pppoe.c |  39 ++++++++++++++++++++++-----------------
 1 files changed, 22 insertions(+), 17 deletions(-)

diffs (71 lines):

diff -r 8dcf782a17cd -r d9652cf26448 sys/net/if_pppoe.c
--- a/sys/net/if_pppoe.c        Wed Feb 01 16:06:19 2017 +0000
+++ b/sys/net/if_pppoe.c        Wed Feb 01 17:58:47 2017 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_pppoe.c,v 1.123 2016/12/27 01:31:06 christos Exp $ */
+/* $NetBSD: if_pppoe.c,v 1.124 2017/02/01 17:58:47 maxv Exp $ */
 
 /*-
  * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.123 2016/12/27 01:31:06 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.124 2017/02/01 17:58:47 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "pppoe.h"
@@ -621,19 +621,21 @@
                case PPPOE_TAG_ACNAME:
                        error = NULL;
                        if (sc != NULL && len > 0) {
-                               error = malloc(len+1, M_TEMP, M_NOWAIT);
-                               if (error) {
-                                       n = m_pulldown(m, off + sizeof(*pt),
-                                           len, &noff);
-                                       if (n) {
-                                               strlcpy(error,
-                                                   mtod(n, char*) + noff,
-                                                   len);
-                                       }
-                                       printf("%s: connected to %s\n",
-                                           devname, error);
+                               error = malloc(len + 1, M_TEMP, M_NOWAIT);
+                               if (error == NULL)
+                                       break;
+
+                               n = m_pulldown(m, off + sizeof(*pt), len,
+                                   &noff);
+                               if (!n) {
+                                       m = NULL;
                                        free(error, M_TEMP);
+                                       goto done;
                                }
+
+                               strlcpy(error, mtod(n, char*) + noff, len + 1);
+                               printf("%s: connected to %s\n", devname, error);
+                               free(error, M_TEMP);
                        }
                        break;  /* ignored */
                case PPPOE_TAG_HUNIQUE: {
@@ -704,12 +706,15 @@
                if (err_msg) {
                        error = NULL;
                        if (errortag && len) {
-                               error = malloc(len+1, M_TEMP, M_NOWAIT);
+                               error = malloc(len + 1, M_TEMP,
+                                   M_NOWAIT|M_ZERO);
                                n = m_pulldown(m, off + sizeof(*pt), len,
                                    &noff);
-                               if (n && error) {
-                                       strlcpy(error, 
-                                           mtod(n, char *) + noff, len);
+                               if (!n) {
+                                       m = NULL;
+                               } else if (error) {
+                                       strlcpy(error, mtod(n, char *) + noff,
+                                           len + 1);
                                }
                        }
                        if (error) {