tcp_lro_rx must free the tags that might be associated with the header
mbuf before it is demoted to an ordinary (not packet header) mbuf.
Details
- Reviewers
ae hiren adrian - Group Reviewers
network - Commits
- rS284961: Fix leak in tcp_lro_rx. Simply clearing M_PKTHDR isn't enough, any tags
Diff Detail
- Repository
- rS FreeBSD src repository - subversion
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
I'd rather we had an m_ function that did the downgrade of pkthdr->no-pkthdr and did the tidyup, like deleting mbuf chain.
That way we can use it everywhere consistently, add assertions, etc.
There is an m_demote() but I thought it would be a bit heavyweight for tcp_lro_rx. We already know m in tcp_lro_rx is a header mbuf, and we don't want to spend time looking at any m->m_next linked mbufs. Maybe I should add this in mbuf.h next to m_demote?
void
m_demote_hdr(struct mbuf *m)
{
M_ASSERTPKTHDR(m);
m_tag_delete_chain(m, NULL);
m->m_flags &= ~M_PKTHDR;
}
Add a generic m_demote_hdr.
I'll build and test with this updated patch. The bzero in
m_demote/m_demote_hdr should perhaps be for kernel with INVARIANTS only.
I'll leave that alone for now.
Use _pkthdr as the suffix as there are existing routines (m_copy_pkthdr,
m_dup_pkthdr, more?) that use _pkthdr and not _hdr.
Add a few assertions in tcp_lro_rx.