Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 1 Apr 2016 01:39:44 +0000 (UTC)
From:      Navdeep Parhar <np@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r297478 - in stable/10/sys: dev/netmap kern
Message-ID:  <201604010139.u311diMK027714@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: np
Date: Fri Apr  1 01:39:44 2016
New Revision: 297478
URL: https://svnweb.freebsd.org/changeset/base/297478

Log:
  MFC r297298:
  Plug leak in m_unshare.
  
  m_unshare passes on the source mbuf's flags as-is to m_getcl and this
  results in a leak if the flags include M_NOFREE.  The fix is to clear
  the bits not listed in M_COPYALL before calling m_getcl.  M_RDONLY
  should probably be filtered out too but that's outside the scope of this
  fix.
  
  Add assertions in the zone_mbuf and zone_pack ctors to catch similar
  bugs.
  
  Update netmap_get_mbuf to not pass M_NOFREE to m_getcl.  It's not clear
  what the original code was trying to do but it's likely incorrect.
  Updated code is no different functionally but it avoids the newly added
  assertions.
  
  Sponsored by:	Chelsio Communications

Modified:
  stable/10/sys/dev/netmap/netmap_generic.c
  stable/10/sys/kern/kern_mbuf.c
  stable/10/sys/kern/uipc_mbuf.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/netmap/netmap_generic.c
==============================================================================
--- stable/10/sys/dev/netmap/netmap_generic.c	Fri Apr  1 01:35:52 2016	(r297477)
+++ stable/10/sys/dev/netmap/netmap_generic.c	Fri Apr  1 01:39:44 2016	(r297478)
@@ -129,8 +129,9 @@ static inline struct mbuf *
 netmap_get_mbuf(int len)
 {
 	struct mbuf *m;
-	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR | M_NOFREE);
+	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 	if (m) {
+		m->m_flags |= M_NOFREE;	/* XXXNP: Almost certainly incorrect. */
 		m->m_ext.ext_arg1 = m->m_ext.ext_buf; // XXX save
 		m->m_ext.ext_free = (void *)netmap_default_mbuf_destructor;
 		m->m_ext.ext_type = EXT_EXTREF;

Modified: stable/10/sys/kern/kern_mbuf.c
==============================================================================
--- stable/10/sys/kern/kern_mbuf.c	Fri Apr  1 01:35:52 2016	(r297477)
+++ stable/10/sys/kern/kern_mbuf.c	Fri Apr  1 01:39:44 2016	(r297478)
@@ -429,6 +429,7 @@ mb_ctor_mbuf(void *mem, int size, void *
 
 	m = (struct mbuf *)mem;
 	flags = args->flags;
+	MPASS((flags & M_NOFREE) == 0);
 
 	error = m_init(m, NULL, size, how, type, flags);
 
@@ -626,6 +627,7 @@ mb_ctor_pack(void *mem, int size, void *
 	args = (struct mb_args *)arg;
 	flags = args->flags;
 	type = args->type;
+	MPASS((flags & M_NOFREE) == 0);
 
 #ifdef INVARIANTS
 	trash_ctor(m->m_ext.ext_buf, MCLBYTES, arg, how);

Modified: stable/10/sys/kern/uipc_mbuf.c
==============================================================================
--- stable/10/sys/kern/uipc_mbuf.c	Fri Apr  1 01:35:52 2016	(r297477)
+++ stable/10/sys/kern/uipc_mbuf.c	Fri Apr  1 01:39:44 2016	(r297478)
@@ -1989,7 +1989,7 @@ m_unshare(struct mbuf *m0, int how)
 		 * don't know how to break up the non-contiguous memory when
 		 * doing DMA.
 		 */
-		n = m_getcl(how, m->m_type, m->m_flags);
+		n = m_getcl(how, m->m_type, m->m_flags & M_COPYFLAGS);
 		if (n == NULL) {
 			m_freem(m0);
 			return (NULL);
@@ -2014,7 +2014,7 @@ m_unshare(struct mbuf *m0, int how)
 				break;
 			off += cc;
 
-			n = m_getcl(how, m->m_type, m->m_flags);
+			n = m_getcl(how, m->m_type, m->m_flags & M_COPYFLAGS);
 			if (n == NULL) {
 				m_freem(mfirst);
 				m_freem(m0);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604010139.u311diMK027714>