From 0b3b29f07b2d3e0afbb4a7dd2c8697fc8b5d5c3a Mon Sep 17 00:00:00 2001 From: np Date: Sat, 26 Mar 2016 23:39:53 +0000 Subject: Plug leak in m_unshare. m_unshare passes on the source mbuf's flags as-is to m_getcl and this results in a leak if the flags include M_NOFREE. The fix is to clear the bits not listed in M_COPYALL before calling m_getcl. M_RDONLY should probably be filtered out too but that's outside the scope of this fix. Add assertions in the zone_mbuf and zone_pack ctors to catch similar bugs. Update netmap_get_mbuf to not pass M_NOFREE to m_getcl. It's not clear what the original code was trying to do but it's likely incorrect. Updated code is no different functionally but it avoids the newly added assertions. Reviewed by: gnn@ Sponsored by: Chelsio Communications Differential Revision: https://reviews.freebsd.org/D5698 --- sys/dev/netmap/netmap_generic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'sys/dev/netmap/netmap_generic.c') diff --git a/sys/dev/netmap/netmap_generic.c b/sys/dev/netmap/netmap_generic.c index bc5b452..9129960 100644 --- a/sys/dev/netmap/netmap_generic.c +++ b/sys/dev/netmap/netmap_generic.c @@ -129,8 +129,9 @@ static inline struct mbuf * netmap_get_mbuf(int len) { struct mbuf *m; - m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR | M_NOFREE); + m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); if (m) { + m->m_flags |= M_NOFREE; /* XXXNP: Almost certainly incorrect. */ m->m_ext.ext_arg1 = m->m_ext.ext_buf; // XXX save m->m_ext.ext_free = (void *)netmap_default_mbuf_destructor; m->m_ext.ext_type = EXT_EXTREF; -- cgit v1.1