Page MenuHomeFreeBSD

if_vxlan: Update *m0 after a pullup
ClosedPublic

Authored by markj on Mon, May 11, 3:11 PM.
Tags
None
Referenced Files
F157159268: D56944.diff
Mon, May 18, 9:25 PM
F157045242: D56944.diff
Mon, May 18, 2:53 AM
Unknown Object (File)
Sun, May 17, 9:03 PM
Unknown Object (File)
Sat, May 16, 9:22 PM
Unknown Object (File)
Fri, May 15, 10:03 PM
Unknown Object (File)
Fri, May 15, 8:29 PM
Unknown Object (File)
Thu, May 14, 1:20 PM
Unknown Object (File)
Tue, May 12, 1:16 AM

Details

Summary

vxlan_input()'s caller is supposed to free *m0 if it is non-NULL after
the function returns. vxlan_input() failed to free *m0 after the pullup
however, so if m_pullup() fails or we hit an error case, we'd free the
mbuf twice.

Reported by: Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Mon, May 11, 3:11 PM

Oops ! My stupid mistake.

vxlan_input() failed to free *m0 after the pullup
however, so if m_pullup() fails or we hit an error case, we'd free the
mbuf twice.

The description is not accurate.

m_pullup() can end up three cases:

  1. It fails. Then the original mbuf is freed, and *m0 is set to NULL. The caller will not free a NULL mbuf. Nothing bad will happen.
  2. It succeeds, but no new mbuf allocated. In this case the m == *m0; Nothing bad will happen.
  3. It succeeds with new mbuf allocated. In this case m != *m0, thus will leak memory and free a freed mbuf.
This revision is now accepted and ready to land.Mon, May 11, 4:17 PM

Oops ! My stupid mistake.

vxlan_input() failed to free *m0 after the pullup
however, so if m_pullup() fails or we hit an error case, we'd free the
mbuf twice.

The description is not accurate.

m_pullup() can end up three cases:

  1. It fails. Then the original mbuf is freed, and *m0 is set to NULL. The caller will not free a NULL mbuf. Nothing bad will happen.

Yes, my mistake.

  1. It succeeds, but no new mbuf allocated. In this case the m == *m0; Nothing bad will happen.

Right.

  1. It succeeds with new mbuf allocated. In this case m != *m0, thus will leak memory and free a freed mbuf.

If an error occurs, yes.

Emm, the if_vxlan(4) is not virtualized yet. @hrs attempted the first, me the second, and @kp the third. It is better to proceed to have tests for it.

Emm, the if_vxlan(4) is not virtualized yet. @hrs attempted the first, me the second, and @kp the third. It is better to proceed to have tests for it.

Sorry, I don't quite follow what you're asking for?

Emm, the if_vxlan(4) is not virtualized yet. @hrs attempted the first, me the second, and @kp the third. It is better to proceed to have tests for it.

Sorry, I don't quite follow what you're asking for?

No, not asking for anything for this revision / review.

the if_vxlan(4) is not virtualized yet

That is a missing feature. See D2868 , D48646 and D52851 .

This revision was automatically updated to reflect the committed changes.