vr(4) leaks mbufs on vr_encap() failure:
- neither vr_encap() nor vr_start() call m_free*()
- *m has been dequeued at call to vr_encap()
Tested by forcing vr_encap() failure and observing 'netstat -m'
While here, prettify a NULL test.
best,
Richard.
vr0 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 10,
address 00:0d:b9:xx:xx:xx
ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI
0x004063, model 0x0034
Index: sys/dev/pci/if_vr.c
===================================================================
--- sys.orig/dev/pci/if_vr.c
+++ sys/dev/pci/if_vr.c
@@ -1324,12 +1324,13 @@ vr_start(struct ifnet *ifp)
}
IFQ_DEQUEUE(&ifp->if_snd, m);
- if (m== NULL)
+ if (m == NULL)
break;
/* Pack the data into the descriptor. */
head_tx = cur_tx;
if (vr_encap(sc, &cur_tx, m)) {
+ m_freem(m);
ifp->if_oerrors++;
continue;
}