git: e273079ac52d - stable/14 - LinuxKPI: 802.11: plug mbuf leak

The branch stable/14 has been updated by bz:

URL: https://cgit.FreeBSD.org/src/commit/?id=e273079ac52d8b2ee9d6a5578cc15dc09a705df8

commit e273079ac52d8b2ee9d6a5578cc15dc09a705df8
Author:     Bjoern A. Zeeb <bz@FreeBSD.org>
AuthorDate: 2025-04-13 16:13:22 +0000
Commit:     Bjoern A. Zeeb <bz@FreeBSD.org>
CommitDate: 2025-04-18 14:36:03 +0000

    LinuxKPI: 802.11: plug mbuf leak
    
    Now that we are doing VHT it is possible to overflow the mbufqs
    we use in the TX and RX paths.  Check the return code of mbufq_enqueue()
    deal with any error accordingly and propagate it.
    
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit c816f64e66a0d21196ede35da3eca19e54b59a03)
---
 sys/compat/linuxkpi/common/src/linux_80211.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c
index 11c0077fe571..3dba41a4e547 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -4530,6 +4530,7 @@ lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
     bool freem)
 {
 	struct lkpi_sta *lsta;
+	int error;
 
 	lsta = ni->ni_drv_data;
 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
@@ -6442,7 +6443,7 @@ linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 	struct ieee80211vap *vap;
 	struct ieee80211_hdr *hdr;
 	struct lkpi_sta *lsta;
-	int i, offset, ok;
+	int i, offset, ok, error;
 	uint8_t rssi;
 	bool is_beacon;
 
@@ -6656,7 +6657,18 @@ skip_device_ts:
 		goto err;
 	}
 
-	mbufq_enqueue(&lhw->rxq, m);
+	error = mbufq_enqueue(&lhw->rxq, m);
+	if (error != 0) {
+		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
+		m_freem(m);
+		counter_u64_add(ic->ic_ierrors, 1);
+#ifdef LINUXKPI_DEBUG_80211
+		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
+			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
+			    __func__, error);
+#endif
+		goto err;
+	}
 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);