From 28e89934a9bec3eca08f4d291a5699485c29d203 Mon Sep 17 00:00:00 2001 From: Adrian Chadd Date: Sun, 27 Apr 2025 16:50:51 -0700 Subject: [PATCH] rtwn: fix mbuf allocation errors in USB RX path for > 4 KiB frames We can and do receive > 4 KiB frames in the RX path (A-MSDU frames can be up to 11KiB.) At least one user has reported seeing this and having it break their traffic flows. Use m_get3() to try and grab an mbuf jumbo cluster. This may not be the best permanent solution, but it at least will fail for frame sizes we expect to see up and including the largest A-MPDU frame (11Kib) and keep a counter if it can't allocate, versus just returning NULL because it's too large (and not keeping counters.) Differential Revision: https://reviews.freebsd.org/D50049 PR: kern/286366 Reviewed by: bz --- sys/dev/rtwn/usb/rtwn_usb_rx.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/sys/dev/rtwn/usb/rtwn_usb_rx.c b/sys/dev/rtwn/usb/rtwn_usb_rx.c index 657d6bdeb9e..4a4294c0d89 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_rx.c +++ b/sys/dev/rtwn/usb/rtwn_usb_rx.c @@ -124,10 +124,15 @@ rtwn_rx_copy_to_mbuf(struct rtwn_softc *sc, struct rtwn_rx_stat_common *stat, if (rtwn_rx_check_pre_alloc(sc, stat) != 0) goto fail; - m = m_get2(totlen, M_NOWAIT, MT_DATA, M_PKTHDR); + /* + * Note: this can require >4 KiB (eg de-aggregating an A-MSDU + * from an USB frame. See kern/286366 for more information. + */ + m = m_get3(totlen, M_NOWAIT, MT_DATA, M_PKTHDR); if (__predict_false(m == NULL)) { - device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n", - __func__); + device_printf(sc->sc_dev, + "%s: could not allocate RX mbuf (%d bytes)\n", + __func__, totlen); goto fail; }