Fixup potential use after free and a memory leak.

Found by Maxime Villard <max at m00nbsd ! net> with the Brainy Code Scanner,
thanks!

diff --git a/sys/dev/pci/hifn7751.c b/sys/dev/pci/hifn7751.c
index d3ff0c5..d3829a7 100644 (file)
--- a/sys/dev/pci/hifn7751.c
+++ b/sys/dev/pci/hifn7751.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: hifn7751.c,v 1.169 2014/07/13 23:10:23 deraadt Exp $  */
+/*     $OpenBSD: hifn7751.c,v 1.170 2015/05/12 12:56:47 mikeb Exp $    */
 
 /*
  * Invertex AEON / Hifn 7751 driver
@@ -2754,8 +2754,10 @@ hifn_mkmbuf_chain(int totlen, struct mbuf *mtemplate)
                }
        }
        MCLGET(m0, M_DONTWAIT);
-       if (!(m0->m_flags & M_EXT))
+       if (!(m0->m_flags & M_EXT)) {
                m_freem(m0);
+               return (NULL);
+       }
        len = MCLBYTES;
 
        totlen -= len;
@@ -2770,6 +2772,7 @@ hifn_mkmbuf_chain(int totlen, struct mbuf *mtemplate)
                }
                MCLGET(m, M_DONTWAIT);
                if (!(m->m_flags & M_EXT)) {
+                       m_free(m);
                        m_freem(m0);
                        return (NULL);
                }