When frag_buffer is freed, we should free its io_buffer structure as well.
However, we don't want to free it when the io_buffer was passed as return
value of ipv4_reassemble().
Signed-off-by: Michal Kubecek <mku...@su...>
---
src/net/ipv4.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/src/net/ipv4.c b/src/net/ipv4.c
index a63738f..6c38d70 100644
--- a/src/net/ipv4.c
+++ b/src/net/ipv4.c
@@ -155,6 +155,8 @@ static void ipv4_frag_expired ( struct retry_timer *timer __unused,
static void free_fragbuf ( struct frag_buffer *fragbuf ) {
list_del ( &fragbuf->list );
stop_timer ( &fragbuf->frag_timer );
+ if ( fragbuf->frag_iob )
+ free_iob ( fragbuf->frag_iob );
free ( fragbuf );
}
@@ -206,6 +208,7 @@ static struct io_buffer * ipv4_reassemble ( struct io_buffer * iobuf ) {
/** Check if the fragment series is over */
if ( ! ( pkt_frags & IP_MASK_MOREFRAGS ) ) {
iobuf = fragbuf->frag_iob;
+ fragbuf->frag_iob = NULL;
free_fragbuf ( fragbuf );
return iobuf;
}
--
1.7.7
|