d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iflib: Fix potential leak in iflib_if_transmit

Browse Source 
Due to an accidental mismatch between allocation and release in the slow path
of iflib_if_transmit, if a caller passed 9-16 mbufs to the routine, the mbuf
array would be leaked.

Fix the mismatch by removing the magic numbers in favor of nitems() on the
stack array.  According to mmacy, this leak is unlikely.

Reported by:	Coverity
Discussed with:	mmacy
CID:		1356040
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-06-07 19:49:08 +00:00
parent 00ee4cd78a
commit 16fb86ab35
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/net/iflib.c
View File

@ -3085,7 +3085,7 @@ iflib_if_transmit(if_t ifp, struct mbuf *m)
next = next->m_nextpkt;
} while (next != NULL);
if (count > 8)
if (count > nitems(marr))
if ((mp = malloc(count*sizeof(struct mbuf *), M_IFLIB, M_NOWAIT)) == NULL) {
/* XXX check nextpkt */
m_freem(m);
@ -3112,7 +3112,7 @@ iflib_if_transmit(if_t ifp, struct mbuf *m)
m_freem(mp[i]);
ifmp_ring_check_drainage(txq->ift_br[0], TX_BATCH_SIZE);
}
if (count > 16)
if (count > nitems(marr))
free(mp, M_IFLIB);
return (err);