diff options
author | np <np@FreeBSD.org> | 2016-03-26 23:39:53 +0000 |
---|---|---|
committer | np <np@FreeBSD.org> | 2016-03-26 23:39:53 +0000 |
commit | 0b3b29f07b2d3e0afbb4a7dd2c8697fc8b5d5c3a (patch) | |
tree | db29218ee04c31aa27d748617ccf56b5533db7ae /sys/kern/kern_mbuf.c | |
parent | 17c3dd308d1aad99eac700aa65049a902ace29fc (diff) | |
download | FreeBSD-src-0b3b29f07b2d3e0afbb4a7dd2c8697fc8b5d5c3a.zip FreeBSD-src-0b3b29f07b2d3e0afbb4a7dd2c8697fc8b5d5c3a.tar.gz |
Plug leak in m_unshare.
m_unshare passes on the source mbuf's flags as-is to m_getcl and this
results in a leak if the flags include M_NOFREE. The fix is to clear
the bits not listed in M_COPYALL before calling m_getcl. M_RDONLY
should probably be filtered out too but that's outside the scope of this
fix.
Add assertions in the zone_mbuf and zone_pack ctors to catch similar
bugs.
Update netmap_get_mbuf to not pass M_NOFREE to m_getcl. It's not clear
what the original code was trying to do but it's likely incorrect.
Updated code is no different functionally but it avoids the newly added
assertions.
Reviewed by: gnn@
Sponsored by: Chelsio Communications
Differential Revision: https://reviews.freebsd.org/D5698
Diffstat (limited to 'sys/kern/kern_mbuf.c')
-rw-r--r-- | sys/kern/kern_mbuf.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c index 1ea8e9d..5e634d7 100644 --- a/sys/kern/kern_mbuf.c +++ b/sys/kern/kern_mbuf.c @@ -424,6 +424,7 @@ mb_ctor_mbuf(void *mem, int size, void *arg, int how) m = (struct mbuf *)mem; flags = args->flags; + MPASS((flags & M_NOFREE) == 0); error = m_init(m, how, type, flags); @@ -572,6 +573,7 @@ mb_ctor_pack(void *mem, int size, void *arg, int how) args = (struct mb_args *)arg; flags = args->flags; type = args->type; + MPASS((flags & M_NOFREE) == 0); #ifdef INVARIANTS trash_ctor(m->m_ext.ext_buf, MCLBYTES, arg, how); |