git: dbc06dd98ae9 - main - LinuxKPI: 802.11 plug mbuf leak in error cases

[Bjoern A. Zeeb]

The branch main has been updated by bz:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=dbc06dd98ae9940377a9ef31a594c17566334977

commit dbc06dd98ae9940377a9ef31a594c17566334977
Author:     Bjoern A. Zeeb <b...@freebsd.org>
AuthorDate: 2022-06-05 18:04:57 +0000
Commit:     Bjoern A. Zeeb <b...@freebsd.org>
CommitDate: 2022-06-05 18:10:24 +0000

    LinuxKPI: 802.11 plug mbuf leak in error cases
    
    Manually free the mbuf in certain error cases from net80211 to not
    leak it.
    Note that the differences between ieee80211_input_mimo() and
    ieee80211_input_mimo_all(), the former not consuming the mbuf while
    the later does, is confusing.
    
    Sponsored by:   The FreeBSD Foundation
    MFC after:      3 days
---
 sys/compat/linuxkpi/common/src/linux_80211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c 
b/sys/compat/linuxkpi/common/src/linux_80211.c
index 6d67c29ed7a6..f2a5d6dac706 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -3870,6 +3870,7 @@ no_trace_beacons:
 
        ok = ieee80211_add_rx_params(m, &rx_stats);
        if (ok == 0) {
+               m_freem(m);
                counter_u64_add(ic->ic_ierrors, 1);
                goto err;
        }
@@ -3960,8 +3961,11 @@ skip_device_ts:
        if (ni != NULL) {
                ok = ieee80211_input_mimo(ni, m);
                ieee80211_free_node(ni);
+               if (ok < 0)
+                       m_freem(m);
        } else {
                ok = ieee80211_input_mimo_all(ic, m);
+               /* mbuf got consumed. */
        }
        NET_EPOCH_EXIT(et);