From nobody Fri Oct 30 17:38:58 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGSyB4sCLz6xG0G for ; Fri, 30 Oct 2026 17:38:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGSyB3lKtz4dpF for ; Fri, 30 Oct 2026 17:38:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381938; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gvDQaG8XZW/fCX6RxLH0RjDgKblfUxRZvwhoUIZONek=; b=G4gJLaibboGQjqVrGGU9rmCHwV3w5CcKQkNQoYh4ef87rqpJoXOh/+BfjOLhexwCz2aehE r+Yuf/o45v9qYIHUzt+nNUFggfDftciGyDEgOhjAbRJ4AiSa1D6fQeh8m/rTZXiJ+Fgzo3 rlRwBiz/9IPakuhdejrDwBPBN5VmhQaacZYz5Vyd8T0UlZPEC3Hs8M9i8y1GK8Cx07OIDM /2FUCPGOzICw18ZR5wwnl4s3J1D0wpKQkNTxjICzERokC8BZpEoeBRrQPW/j0CmoLdx+TI i0F9ur104AN4yz9mwmTKWjmZCGvYdbj66d+AiiphzEFIylsx6lmtxBJA+7aSew== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793381938; b=rjXS+eK6rbzugKGlpX6YSB310gvHJ0BfDIrzj1cOMezuZNdnJgoheAwmy/i3IxN8a5uHoK k9FFNL1HHUc3T+1jISANMhBrca1KqFjMiASoJG2nyLlLGCyKem4isu+9TxfUac9k4OZ3W6 KOlpxpq887wW7fTbcdJgrCuGjP1C9g/YjoPLDT+s1wiI2KnPJCXAkJD8Ggbl68f4q0LAMX MAMqwyhl25NifYOd1YPD19W8XcusC7WjojwVhe2wlCkTTalZtulBhQxcnX2UXn5rT19T+H xIyWVFChkxY2qKDWmwgoTK34EQcNwbvTQIPPJIVMOoaJknQt8nTyXnirk+2cQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381938; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=gvDQaG8XZW/fCX6RxLH0RjDgKblfUxRZvwhoUIZONek=; b=MHc7BJRGczz3TUjhuj4Bp0FNSK8C4YjcSYpjpunKswfnJuP443vpxmYFGYTPj3IJFXDuPz Bj72JsW5JZieigGaDWA1alMxqA1uuoEFtEXfOj8i49Ze2gNw+PL80GqXt9jMTsRT5Pky3t ZYc1xvEOi5DJ5RAMPF7vG+R3vcQuc87YdFfP+cUQaZ7hyH3ttSpP6Vfw7b+60H46pHnupH R+POPnf44x0jcnRn208mB07/1Dmn5Tzjt+5RjCtTJMztJdKGC5Z32dWXQzUG8wxOXvZpPO EIOD0GC7bNN2j9NGiT5ONggYHJb0f+FQxunWObzXX4jz0e6Qf9gXQmQBSKqkQw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGSyB3PPbzdth for ; Fri, 30 Oct 2026 17:38:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e77e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 17:38:58 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Adrian Chadd From: Kevin Bowling Subject: git: 6ff264d47f99 - stable/15 - ath: fix ath_buf leak if ath_tx_tag_crypto() returns an error List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kbowling X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 6ff264d47f9970a1c6be03b48374110b56ef4ba5 Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 17:38:58 +0000 Message-Id: <6ae4d632.3e77e.1ac71c42@gitrepo.freebsd.org> The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=6ff264d47f9970a1c6be03b48374110b56ef4ba5 commit 6ff264d47f9970a1c6be03b48374110b56ef4ba5 Author: Adrian Chadd AuthorDate: 2025-10-01 02:21:01 +0000 Commit: Kevin Bowling CommitDate: 2026-10-30 17:37:46 +0000 ath: fix ath_buf leak if ath_tx_tag_crypto() returns an error If ath_tx_tag_crypto() returns an error, then ath_tx_normal_setup() should consume the mbuf and return an error, so the caller knows to free the ath_buf. But it wasn't. This fixes issues I've seen locally where a an AP VAP constantly hits error conditions (due to other RF/PHY/MAC chipset issues which I haven't yet figured out) and encryption fails because the station goes away whilst something's being queued. Locally tested: * AR9380, AP mode (2G HT20, 5G HT20, 5G HT40) (cherry picked from commit f7aad20db59210a4411559d07976a48809b3b0a7) --- sys/dev/ath/if_ath_tx.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/sys/dev/ath/if_ath_tx.c b/sys/dev/ath/if_ath_tx.c index 1559b66a7c7d..20a205ddebbf 100644 --- a/sys/dev/ath/if_ath_tx.c +++ b/sys/dev/ath/if_ath_tx.c @@ -971,6 +971,12 @@ ath_legacy_xmit_handoff(struct ath_softc *sc, struct ath_txq *txq, ath_tx_handoff_hw(sc, txq, bf); } +/* + * Setup a frame for encryption. + * + * If this fails, then an non-zero error is returned. The mbuf + * must be freed by the caller. + */ static int ath_tx_tag_crypto(struct ath_softc *sc, struct ieee80211_node *ni, struct mbuf *m0, int iswep, int isfrag, int *hdrlen, int *pktlen, @@ -1547,6 +1553,10 @@ ath_tx_xmit_normal(struct ath_softc *sc, struct ath_txq *txq, * * Note that this may cause the mbuf to be reallocated, so * m0 may not be valid. + * + * If there's a problem then the mbuf is freed and an error + * is returned. The ath_buf then needs to be freed by the + * caller. */ static int ath_tx_normal_setup(struct ath_softc *sc, struct ieee80211_node *ni, @@ -2069,9 +2079,8 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, /* This also sets up the DMA map; crypto; frame parameters, etc */ r = ath_tx_normal_setup(sc, ni, bf, m0, txq); - if (r != 0) - goto done; + return (r); /* At this point m0 could have changed! */ m0 = bf->bf_m; @@ -2128,7 +2137,6 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, ath_tx_leak_count_update(sc, tid, bf); ath_tx_xmit_normal(sc, txq, bf); #endif -done: return 0; }