Module Name: src
Committed By: martin
Date: Wed Sep 11 16:18:36 UTC 2024
Modified Files:
src/sys/net [netbsd-10]: nd.c
Log Message:
Pull up following revision(s) (requested by rin in ticket #827):
sys/net/nd.c: revision 1.6
sys/net/nd.c: revision 1.7
nd_resolve: Maintain la_numheld.
Otherwise lltable_drop_entry_queue never drops anything.
Addresses mbuf leak, PR kern/58297.
nd_timer: Update la_numheld when we clear la_hold (a.k.a. ln_hold).
Followup for PR kern/58297 fix. Patch by mlelstv@.
PR kern/58301
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.5.2.1 src/sys/net/nd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net/nd.c
diff -u src/sys/net/nd.c:1.5 src/sys/net/nd.c:1.5.2.1
--- src/sys/net/nd.c:1.5 Sat Nov 19 08:00:51 2022
+++ src/sys/net/nd.c Wed Sep 11 16:18:36 2024
@@ -1,4 +1,4 @@
-/* $NetBSD: nd.c,v 1.5 2022/11/19 08:00:51 yamt Exp $ */
+/* $NetBSD: nd.c,v 1.5.2.1 2024/09/11 16:18:36 martin Exp $ */
/*
* Copyright (c) 2020 The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nd.c,v 1.5 2022/11/19 08:00:51 yamt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nd.c,v 1.5.2.1 2024/09/11 16:18:36 martin Exp $");
#include <sys/callout.h>
#include <sys/mbuf.h>
@@ -105,8 +105,12 @@ nd_timer(void *arg)
m->m_nextpkt = NULL;
ln->ln_hold = NULL;
+ ln->la_numheld = 0;
}
+ KASSERTMSG(ln->la_numheld == 0, "la_numheld=%d",
+ ln->la_numheld);
+
missed = ND_LLINFO_INCOMPLETE;
ln->ln_state = ND_LLINFO_WAITDELETE;
break;
@@ -374,14 +378,25 @@ nd_resolve(struct llentry *ln, const str
break;
}
}
+ KASSERTMSG(ln->la_numheld == i, "la_numheld=%d i=%d",
+ ln->la_numheld, i);
while (i >= nd->nd_maxqueuelen) {
m_hold = ln->ln_hold;
ln->ln_hold = ln->ln_hold->m_nextpkt;
m_freem(m_hold);
i--;
+ ln->la_numheld--;
}
- } else
+ } else {
+ KASSERTMSG(ln->la_numheld == 0, "la_numheld=%d",
+ ln->la_numheld);
ln->ln_hold = m;
+ }
+
+ KASSERTMSG(ln->la_numheld < nd->nd_maxqueuelen,
+ "la_numheld=%d nd_maxqueuelen=%d",
+ ln->la_numheld, nd->nd_maxqueuelen);
+ ln->la_numheld++;
if (ln->ln_asked >= nd->nd_mmaxtries)
error = (rt != NULL && rt->rt_flags & RTF_GATEWAY) ?
