mbuf leak in bpf.c

Johnny Eriksson bygg at cafax.se
Mon Dec 27 03:24:52 PST 2004


If one tries to write a datagram to a bpf device, and the datagram is
longer than the MTU on the physical interface, the write fails as it
should, but an mbuf is allocated and thrown away.  Proposed solution:

--- bpf.c.orig  Mon Dec 27 10:43:06 2004
+++ bpf.c       Mon Dec 27 10:44:16 2004
@@ -633,8 +633,10 @@
        if (error)
                return (error);
 
-       if (datlen > ifp->if_mtu)
+       if (datlen > ifp->if_mtu) {
+               m_freem(m);
                return (EMSGSIZE);
+       }
 
        if (d->bd_hdrcmplt)
                dst.sa_family = pseudo_AF_HDRCMPLT;

--Johnny


More information about the freebsd-stable mailing list