Module Name: src
Committed By: riastradh
Date: Tue May 28 22:15:22 UTC 2024
Modified Files:
src/sys/net: nd.c
Log Message:
nd_resolve: Maintain la_numheld.
Otherwise lltable_drop_entry_queue never drops anything.
Addresses mbuf leak, PR kern/58297.
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/sys/net/nd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/nd.c
diff -u src/sys/net/nd.c:1.5 src/sys/net/nd.c:1.6
--- src/sys/net/nd.c:1.5 Sat Nov 19 08:00:51 2022
+++ src/sys/net/nd.c Tue May 28 22:15:22 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: nd.c,v 1.5 2022/11/19 08:00:51 yamt Exp $ */
+/* $NetBSD: nd.c,v 1.6 2024/05/28 22:15:22 riastradh Exp $ */
/*
* Copyright (c) 2020 The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd.c,v 1.5 2022/11/19 08:00:51 yamt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd.c,v 1.6 2024/05/28 22:15:22 riastradh Exp $");
#include <sys/callout.h>
#include <sys/mbuf.h>
@@ -374,14 +374,25 @@ nd_resolve(struct llentry *ln, const str
break;
}
}
+ KASSERTMSG(ln->la_numheld == i, "la_numheld=%d i=%d",
+ ln->la_numheld, i);
while (i >= nd->nd_maxqueuelen) {
m_hold = ln->ln_hold;
ln->ln_hold = ln->ln_hold->m_nextpkt;
m_freem(m_hold);
i--;
+ ln->la_numheld--;
}
- } else
+ } else {
+ KASSERTMSG(ln->la_numheld == 0, "la_numheld=%d",
+ ln->la_numheld);
ln->ln_hold = m;
+ }
+
+ KASSERTMSG(ln->la_numheld < nd->nd_maxqueuelen,
+ "la_numheld=%d nd_maxqueuelen=%d",
+ ln->la_numheld, nd->nd_maxqueuelen);
+ ln->la_numheld++;
if (ln->ln_asked >= nd->nd_mmaxtries)
error = (rt != NULL && rt->rt_flags & RTF_GATEWAY) ?
