From fdc22de28e089d498091b2dd98dd0602bd67b2e2 Mon Sep 17 00:00:00 2001 From: np Date: Fri, 1 Apr 2016 01:39:44 +0000 Subject: [PATCH] MFC r297298: Plug leak in m_unshare. m_unshare passes on the source mbuf's flags as-is to m_getcl and this results in a leak if the flags include M_NOFREE. The fix is to clear the bits not listed in M_COPYALL before calling m_getcl. M_RDONLY should probably be filtered out too but that's outside the scope of this fix. Add assertions in the zone_mbuf and zone_pack ctors to catch similar bugs. Update netmap_get_mbuf to not pass M_NOFREE to m_getcl. It's not clear what the original code was trying to do but it's likely incorrect. Updated code is no different functionally but it avoids the newly added assertions. Sponsored by: Chelsio Communications --- sys/dev/netmap/netmap_generic.c | 3 ++- sys/kern/kern_mbuf.c | 2 ++ sys/kern/uipc_mbuf.c | 4 ++-- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/dev/netmap/netmap_generic.c b/sys/dev/netmap/netmap_generic.c index ecdb3682407..4983516806f 100644 --- a/sys/dev/netmap/netmap_generic.c +++ b/sys/dev/netmap/netmap_generic.c @@ -129,8 +129,9 @@ static inline struct mbuf * netmap_get_mbuf(int len) { struct mbuf *m; - m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR | M_NOFREE); + m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); if (m) { + m->m_flags |= M_NOFREE; /* XXXNP: Almost certainly incorrect. */ m->m_ext.ext_arg1 = m->m_ext.ext_buf; // XXX save m->m_ext.ext_free = (void *)netmap_default_mbuf_destructor; m->m_ext.ext_type = EXT_EXTREF; diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c index c232a375549..7f9f66641e4 100644 --- a/sys/kern/kern_mbuf.c +++ b/sys/kern/kern_mbuf.c @@ -429,6 +429,7 @@ mb_ctor_mbuf(void *mem, int size, void *arg, int how) m = (struct mbuf *)mem; flags = args->flags; + MPASS((flags & M_NOFREE) == 0); error = m_init(m, NULL, size, how, type, flags); @@ -626,6 +627,7 @@ mb_ctor_pack(void *mem, int size, void *arg, int how) args = (struct mb_args *)arg; flags = args->flags; type = args->type; + MPASS((flags & M_NOFREE) == 0); #ifdef INVARIANTS trash_ctor(m->m_ext.ext_buf, MCLBYTES, arg, how); diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index 01e4c310cb1..df03928b872 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -1989,7 +1989,7 @@ m_unshare(struct mbuf *m0, int how) * don't know how to break up the non-contiguous memory when * doing DMA. */ - n = m_getcl(how, m->m_type, m->m_flags); + n = m_getcl(how, m->m_type, m->m_flags & M_COPYFLAGS); if (n == NULL) { m_freem(m0); return (NULL); @@ -2014,7 +2014,7 @@ m_unshare(struct mbuf *m0, int how) break; off += cc; - n = m_getcl(how, m->m_type, m->m_flags); + n = m_getcl(how, m->m_type, m->m_flags & M_COPYFLAGS); if (n == NULL) { m_freem(mfirst); m_freem(m0);