d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bridge: Fix a potential memory leak in bridge_enqueue()

Browse Source 
A comment at the beginning of the function notes that we may be
transmitting multiple fragments as distinct packets.  So, the function
loops over all fragments, transmitting each mbuf chain.  If if_transmit
fails, we need to free all of the fragments, but m_freem() only frees an
mbuf chain - it doesn't follow m_nextpkt.

Change the error handler to free each untransmitted packet fragment, and
count each fragment as a separate error since we increment OPACKETS once
per fragment when transmission is successful.

Reviewed by:	zlei, kp
MFC after:	1 week
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D37635
This commit is contained in:
Mark Johnston 2022-12-11 11:40:12 -05:00
parent be39466a10
commit 5108879730
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/net/if_bridge.c
View File

@ -2062,8 +2062,13 @@ bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
M_ASSERTPKTHDR(m); /* We shouldn't transmit mbuf without pkthdr */
if ((err = dst_ifp->if_transmit(dst_ifp, m))) {
m_freem(m0);
if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
int n;
for (m = m0, n = 1; m != NULL; m = m0, n++) {
m0 = m->m_nextpkt;
m_freem(m);
}
if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, n);
break;
}