Just in case. NULL derefs are easier to find than use-after-frees.

Index: if_iwm.c
===================================================================
RCS file: /cvs/src/sys/dev/pci/if_iwm.c,v
retrieving revision 1.53
diff -u -p -r1.53 if_iwm.c
--- if_iwm.c    6 Oct 2015 09:12:00 -0000       1.53
+++ if_iwm.c    10 Oct 2015 08:35:08 -0000
@@ -1062,6 +1062,7 @@ iwm_free_rx_ring(struct iwm_softc *sc, s
                            data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
                        bus_dmamap_unload(sc->sc_dmat, data->map);
                        m_freem(data->m);
+                       data->m = NULL;
                }
                if (data->map != NULL)
                        bus_dmamap_destroy(sc->sc_dmat, data->map);
@@ -1169,6 +1170,7 @@ iwm_free_tx_ring(struct iwm_softc *sc, s
                            data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
                        bus_dmamap_unload(sc->sc_dmat, data->map);
                        m_freem(data->m);
+                       data->m = NULL;
                }
                if (data->map != NULL)
                        bus_dmamap_destroy(sc->sc_dmat, data->map);

Reply via email to