From nobody Wed Oct 1 02:24:17 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cbzJd6VDQz69pRB; Wed, 01 Oct 2025 02:24:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cbzJd5hc5z3G5s; Wed, 01 Oct 2025 02:24:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1759285457; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sDgmwT3d5qcUch7KDlZWrkdtkpWynDLVTQWhVCxtaY0=; b=xXBRmSYNEgXVbT3xPGJmRCuomXamjdMp64xnhYDeTD9v/AxjwM8WeLbCcX9yTwCviK9KuJ Z6gp/BE0nLedBs/kKImaQnJ6zfr5Zg5OulDjKM8Fo8xsWu+3Jh1A1B+xTHgKb7/4hDwpHI SH71sf+GpaXLtCy/cOLd1Jaiy0CtYPfG0PSrMMt39b9m19w6UuX+4t0iiGn89lg+3Zs6oW /dAMLsrKIJd18RVEz6SHfDfq4/zco5kj8hfmJ1Snal3DbjGNfSjg6xGMO7uaxeu2QBZpCO T5EM7QqSxEsrxKBGUmv/Jg5ori1nn7VcaGcv8enPY+bW4w50h8l1COUXx5la8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1759285457; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=sDgmwT3d5qcUch7KDlZWrkdtkpWynDLVTQWhVCxtaY0=; b=i0PpQ5rAyb92X2X8p6b6gyb36nvZjIV1nKeDIdvK9vS+t/M4qxNXt+jRqDDz6nxuqVv2Tn PvpjhNIX6bVNj5RiULXvPOOW3h4TNs6E1e4rA+2OK2EezEQNGIL8Rif5cHq9EK2hQ2057w xJVc50KNijHSyWIUapM9k6lZ2oF7LcZwVLr4z4mNaQofo8khIppwyYlNzt6Pn1CqUMSnkm tIB1VjmDVURX9Evf+Yyot1R8AmMmeMZ9bB36RI0qDIvPhFuBQqhAFiyq8pJNOFpDgAjyQM WSN2RMoK4kggudKs/AIQLiV5IhHwvPplGCOKDD2zquno+iA5V1oc36HulalILw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1759285457; a=rsa-sha256; cv=none; b=NqbkW83C/Eg7X2fSypwGJLrOHotJyQC2oVM8PNEvMFnvQzMZv1d0fD33Jk4MCG3xaerF7A 9r2kZAtO4zm3ahWvUijERPCt0WM0V7HuuR28T9l+uBviqy6cymd/pnOV1c69vFuMevo3zS 76KRfT8u+2myo6vu9nDmVgp7CfbLPtPLtBChVihOF7TIw/m7sS08LAyxsPfhkjL+GXRNdU D5c40K4d9aBp1dboj9xRdmb9y/QhnQmnvBScLgg+YTbFJXmkvXBaNI/bY9OuRJXqTipLme VqrbWrxWzDbr0opPvEmCvYYm3Kpcq9S51xvkTTuG3ajUy00N0W45I0DY/OPv5Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4cbzJd4zM8z12nx; Wed, 01 Oct 2025 02:24:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 5912OHSM092992; Wed, 1 Oct 2025 02:24:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 5912OHFM092989; Wed, 1 Oct 2025 02:24:17 GMT (envelope-from git) Date: Wed, 1 Oct 2025 02:24:17 GMT Message-Id: <202510010224.5912OHFM092989@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Adrian Chadd Subject: git: f7aad20db592 - main - ath: fix ath_buf leak if ath_tx_tag_crypto() returns an error List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adrian X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f7aad20db59210a4411559d07976a48809b3b0a7 Auto-Submitted: auto-generated The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=f7aad20db59210a4411559d07976a48809b3b0a7 commit f7aad20db59210a4411559d07976a48809b3b0a7 Author: Adrian Chadd AuthorDate: 2025-10-01 02:21:01 +0000 Commit: Adrian Chadd CommitDate: 2025-10-01 02:21:01 +0000 ath: fix ath_buf leak if ath_tx_tag_crypto() returns an error If ath_tx_tag_crypto() returns an error, then ath_tx_normal_setup() should consume the mbuf and return an error, so the caller knows to free the ath_buf. But it wasn't. This fixes issues I've seen locally where a an AP VAP constantly hits error conditions (due to other RF/PHY/MAC chipset issues which I haven't yet figured out) and encryption fails because the station goes away whilst something's being queued. Locally tested: * AR9380, AP mode (2G HT20, 5G HT20, 5G HT40) --- sys/dev/ath/if_ath_tx.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/sys/dev/ath/if_ath_tx.c b/sys/dev/ath/if_ath_tx.c index deadd63c3d18..9ac591c14943 100644 --- a/sys/dev/ath/if_ath_tx.c +++ b/sys/dev/ath/if_ath_tx.c @@ -971,6 +971,12 @@ ath_legacy_xmit_handoff(struct ath_softc *sc, struct ath_txq *txq, ath_tx_handoff_hw(sc, txq, bf); } +/* + * Setup a frame for encryption. + * + * If this fails, then an non-zero error is returned. The mbuf + * must be freed by the caller. + */ static int ath_tx_tag_crypto(struct ath_softc *sc, struct ieee80211_node *ni, struct mbuf *m0, int iswep, int isfrag, int *hdrlen, int *pktlen, @@ -1547,6 +1553,10 @@ ath_tx_xmit_normal(struct ath_softc *sc, struct ath_txq *txq, * * Note that this may cause the mbuf to be reallocated, so * m0 may not be valid. + * + * If there's a problem then the mbuf is freed and an error + * is returned. The ath_buf then needs to be freed by the + * caller. */ static int ath_tx_normal_setup(struct ath_softc *sc, struct ieee80211_node *ni, @@ -2073,9 +2083,8 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, /* This also sets up the DMA map; crypto; frame parameters, etc */ r = ath_tx_normal_setup(sc, ni, bf, m0, txq); - if (r != 0) - goto done; + return (r); /* At this point m0 could have changed! */ m0 = bf->bf_m; @@ -2132,7 +2141,6 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, ath_tx_leak_count_update(sc, tid, bf); ath_tx_xmit_normal(sc, txq, bf); #endif -done: return 0; }