From nobody Mon Jan 19 15:50:01 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dvvzY64CDz6NyZS for ; Mon, 19 Jan 2026 15:50:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dvvzY4FPGz3qZQ for ; Mon, 19 Jan 2026 15:50:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768837801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yjquCRfFG38L+lJX6lHNkSfyLiJYySD8+BswKac1A78=; b=hxPns3bhg6PnOTbYA2+6c8lDcxL0MgZOfRDdMmGSqMS2h/e13xLxOUFwttAK89MPzqiwUp 3r5uW+UMd29r2UmZXbi4jybXmqBz6vDBxi8H0ClHsXjwMrkf2RPjuX0D89gJkR1p9wlKMK SP9C19/2C5FjblT7KgQZkT+IY0sUe4SVPUXKVCTZgRoBlAO3jpKnEY/Z/JSG8T7jGCAVsc iE7XHDWShqNcE1tY80NlNJzQL7fptCqTekRgO9FpMuZOPU0xymlIQAfgZcoMjIJ3Fd9ZMs 3t0C3ok4TxZZNrle0PuGhloKd0K8wAEjT7217sEzusBjyDG2PsT3bmtgg0Gmpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768837801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yjquCRfFG38L+lJX6lHNkSfyLiJYySD8+BswKac1A78=; b=WE4/FHlFDDe34SEJO5RbotdptDEgCepz1o03EkU4MDriixVf6ij7kKs02X3B6d1wntiFd8 1wzv1pKAAYyPRA9rMVzHXRI5X/Bqbkax++b8NdYZXxYJpmbU8tXNoB2vt73420BUPEljFh v3p7G1eiNCnEyJdh0lmXSFsJCmfXbPJUSeyZaquLyTGmV/80z1lMRyh9IQK5VJCnrd1Tww v5Z+Dg7MlBXzYyYHZ0xS/yeyYBOdEj+uYlD2GLx7qyaDuo5Hervs8v7fBI+KPytZEEjjEX 0EwFsN2lgLU9DYKGIc5EBUaKE/nW5P3J98WBo/tGiUrZrQlIics3zw9qP8w+KA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1768837801; a=rsa-sha256; cv=none; b=CxU7X6Tgqz4SWsxDkWD9wDR2W899/RFTjETkz5+mM4NKM4tX8ayAZXWJBVGjo/72ldok9F 0Pc4PLOMYJpDiFiqDLS0iYbiBSGTRcKraVTyOss/P6EvSEG/skQ8cs3ybjEBZ8hIFOkmJ3 WMUKUSJB2mPZLYqOtQQkK8ssxY8doPdTTvVEbbuGFNN6n+2KHI2tCkBXjUVu9lANZaCKTd yQi32i9BzPiEZZWLpnuey7j1+GFsym+YCTJP5gtUvcf+x2/CNBmM/9+7MvHqfyJ4d8qrmk Lc+M9OvxNyA0f6x0ARuQ3Kf/AmaJrt0noDJLqptg5WdHNE/hJvpZNTGtZKKOAQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dvvzY3p3pzfMT for ; Mon, 19 Jan 2026 15:50:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 308e8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 19 Jan 2026 15:50:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Andrew Gallatin Subject: git: d91ae61f8fc2 - main - iflib: null out freed mbuf in iflib_txsd_free List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gallatin X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d91ae61f8fc2dd4ab3c208f25570b91a0725e2e4 Auto-Submitted: auto-generated Date: Mon, 19 Jan 2026 15:50:01 +0000 Message-Id: <696e52a9.308e8.211fdd74@gitrepo.freebsd.org> The branch main has been updated by gallatin: URL: https://cgit.FreeBSD.org/src/commit/?id=d91ae61f8fc2dd4ab3c208f25570b91a0725e2e4 commit d91ae61f8fc2dd4ab3c208f25570b91a0725e2e4 Author: Andrew Gallatin AuthorDate: 2026-01-19 15:41:02 +0000 Commit: Andrew Gallatin CommitDate: 2026-01-19 15:45:49 +0000 iflib: null out freed mbuf in iflib_txsd_free When adding the IFLIB_GET_MBUF/FLAGS, I neglected to NULL out the mbuf in the descriptor ring. I didn't think this should matter as the I thought this code was only used when the ring was about to be freed. But I was wrong, and leaving a stale mbuf in there can cause panics. Reported by: Marek Zarychta (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292547) Fixes: 14d93f612f26 Sponsored by: Netflix --- sys/net/iflib.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/net/iflib.c b/sys/net/iflib.c index 5c37f199e84c..b0e4bb9470c9 100644 --- a/sys/net/iflib.c +++ b/sys/net/iflib.c @@ -1890,6 +1890,7 @@ iflib_txsd_free(if_ctx_t ctx, iflib_txq_t txq, int i) bus_dmamap_unload(txq->ift_tso_buf_tag, txq->ift_sds.ifsd_tso_map[i]); } + txq->ift_sds.ifsd_m[i] = NULL; m_freem(m); DBG_COUNTER_INC(tx_frees); }