vr(4) leaks mbufs on vr_encap() failure:

  - neither vr_encap() nor vr_start() call m_free*()
  - *m has been dequeued at call to vr_encap()

Tested by forcing vr_encap() failure and observing 'netstat -m'

While here, prettify a NULL test.

best, 
Richard. 

vr0 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 10, 
address 00:0d:b9:xx:xx:xx
ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 
0x004063, model 0x0034

Index: sys/dev/pci/if_vr.c
===================================================================
--- sys.orig/dev/pci/if_vr.c
+++ sys/dev/pci/if_vr.c
@@ -1324,12 +1324,13 @@ vr_start(struct ifnet *ifp)
                }
 
                IFQ_DEQUEUE(&ifp->if_snd, m);
-               if (m== NULL)
+               if (m == NULL)
                        break;
 
                /* Pack the data into the descriptor. */
                head_tx = cur_tx;
                if (vr_encap(sc, &cur_tx, m)) {
+                       m_freem(m);
                        ifp->if_oerrors++;
                        continue;
                }

Reply via email to