From nobody Fri Apr 18 14:37:28 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZfHRF0xrvz5stYt; Fri, 18 Apr 2025 14:37:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZfHRD3xlwz3KtC; Fri, 18 Apr 2025 14:37:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744987048; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LzKSAq4D5BuKVaQ9rFC1728wXOQ66o7Hs4i5h1kPGKg=; b=CRxDnTKdPtxmNz6OsD6MyhHid2EDZ1rpbFiVx5rlUUv5vKaKCXxCdv646OpQ/ukXSVD6J8 miWSirHI3Icfa9LshA+WcweVcLMImrsrGY+jx64Pd1Qm+kPBYz1c5JmbJbSjX9juXeOCas SvCztC063REi791VGjb1qVX3EJekRxw+NZE/OFwo1URQE2EKIuv1Ty6ffJGPDIUdSW4nr3 lJEIZmkw6dZuviGSrQs4bEzu5GGEqcuXdCCMknkgVFoo1yZ4bThuJ4R+EqrRF/lqhL/joW g6UdqFPDg541MFHE7T1FifI9prjOGYQnmM6RW8/p45EU82vHb8PaQ0z/l5iBWw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1744987048; a=rsa-sha256; cv=none; b=dYkaE8hIWu3HW7J9NFZMsc/HlDj6WwFiHnezCvVV2NoodiNE2Xkt9kbydFBUKczK/+5kWi kTYpAuJe4tjT+3nSvPuITqHth8BrksBJfYYWt4zRL/Pc3N3AoTGqCAwB9f4DXrr3tg+UFS pv3aVzSUsOViBIAVqW3hhuX+Ey3DGpz2nh1qUiKZZJX35lSC2qvccPsEPpslkhXar51UEB AqhIzdLKDFcO6/iZFQb55Q6kYV607mW8+tkfBl38J8XZ4HunvlsrU0UOkYhqhZ5GJ6+nM3 tyD9mvkdbnX7OrNLV7NhDRKZ5RJ6ZFPTwNY64vdbgW7nFuN9FL+SmYSEsHqGZQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744987048; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LzKSAq4D5BuKVaQ9rFC1728wXOQ66o7Hs4i5h1kPGKg=; b=l0Nv5QfMZ1MdQx/XrtUm0WLdxiihIEd2IpDk9QE9pcfOStnRWT6hBHfY9QjDzn8pw2Zrhi b7Ka0v55umsMqnkCbtdhLAKWIorCGSBIdFGraZg8JYTSp7mnoI6ok/Srhx5a8dLxa5ZTZC l5z32tOjRMsk2WWQKGyWwrsy41LQ4eAl/c8mEEAa1p4ISHRNuPFvJIEUGx2Rir3/22h196 eV6ydw0wngMJ0frJa31vG3g2dM2uP7UmhNhks7urF7O/E3yPAX1SyuerENTfKRIGscCx3B jiPgdOGRbngeoFW5iBDzfJ+0HEW2KTH1DPEJpAbx/uIMaMFpORBK1TjA6HnFNQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ZfHRD3TRZzfHN; Fri, 18 Apr 2025 14:37:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53IEbSDG092323; Fri, 18 Apr 2025 14:37:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53IEbSlD092320; Fri, 18 Apr 2025 14:37:28 GMT (envelope-from git) Date: Fri, 18 Apr 2025 14:37:28 GMT Message-Id: <202504181437.53IEbSlD092320@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: "Bjoern A. Zeeb" Subject: git: e273079ac52d - stable/14 - LinuxKPI: 802.11: plug mbuf leak List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: e273079ac52d8b2ee9d6a5578cc15dc09a705df8 Auto-Submitted: auto-generated The branch stable/14 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=e273079ac52d8b2ee9d6a5578cc15dc09a705df8 commit e273079ac52d8b2ee9d6a5578cc15dc09a705df8 Author: Bjoern A. Zeeb AuthorDate: 2025-04-13 16:13:22 +0000 Commit: Bjoern A. Zeeb CommitDate: 2025-04-18 14:36:03 +0000 LinuxKPI: 802.11: plug mbuf leak Now that we are doing VHT it is possible to overflow the mbufqs we use in the TX and RX paths. Check the return code of mbufq_enqueue() deal with any error accordingly and propagate it. Sponsored by: The FreeBSD Foundation (cherry picked from commit c816f64e66a0d21196ede35da3eca19e54b59a03) --- sys/compat/linuxkpi/common/src/linux_80211.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 11c0077fe571..3dba41a4e547 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -4530,6 +4530,7 @@ lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m, bool freem) { struct lkpi_sta *lsta; + int error; lsta = ni->ni_drv_data; LKPI_80211_LSTA_TXQ_LOCK(lsta); @@ -6442,7 +6443,7 @@ linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb, struct ieee80211vap *vap; struct ieee80211_hdr *hdr; struct lkpi_sta *lsta; - int i, offset, ok; + int i, offset, ok, error; uint8_t rssi; bool is_beacon; @@ -6656,7 +6657,18 @@ skip_device_ts: goto err; } - mbufq_enqueue(&lhw->rxq, m); + error = mbufq_enqueue(&lhw->rxq, m); + if (error != 0) { + LKPI_80211_LHW_RXQ_UNLOCK(lhw); + m_freem(m); + counter_u64_add(ic->ic_ierrors, 1); +#ifdef LINUXKPI_DEBUG_80211 + if (linuxkpi_debug_80211 & D80211_TRACE_RX) + ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n", + __func__, error); +#endif + goto err; + } taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task); LKPI_80211_LHW_RXQ_UNLOCK(lhw);