Author: cem
Date: Tue Jun 7 19:49:08 2016
New Revision: 301563
URL: https://svnweb.freebsd.org/changeset/base/301563
Log:
iflib: Fix potential leak in iflib_if_transmit
Due to an accidental mismatch between allocation and release in the slow path
of iflib_if_transmit, if a caller passed 9-16 mbufs to the routine, the mbuf
array would be leaked.
Fix the mismatch by removing the magic numbers in favor of nitems() on the
stack array. According to mmacy, this leak is unlikely.
Reported by: Coverity
Discussed with: mmacy
CID: 1356040
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/net/iflib.c
Modified: head/sys/net/iflib.c
==============================================================================
--- head/sys/net/iflib.c Tue Jun 7 19:08:13 2016 (r301562)
+++ head/sys/net/iflib.c Tue Jun 7 19:49:08 2016 (r301563)
@@ -3085,7 +3085,7 @@ iflib_if_transmit(if_t ifp, struct mbuf
next = next->m_nextpkt;
} while (next != NULL);
- if (count > 8)
+ if (count > nitems(marr))
if ((mp = malloc(count*sizeof(struct mbuf *), M_IFLIB,
M_NOWAIT)) == NULL) {
/* XXX check nextpkt */
m_freem(m);
@@ -3112,7 +3112,7 @@ iflib_if_transmit(if_t ifp, struct mbuf
m_freem(mp[i]);
ifmp_ring_check_drainage(txq->ift_br[0], TX_BATCH_SIZE);
}
- if (count > 16)
+ if (count > nitems(marr))
free(mp, M_IFLIB);
return (err);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
