kern/44196: possible mbuf leak when writing to BPF with BIOCSFEEDBACK

[Takahiro HAYASHI <hash%abox3.so-net.ne.jp@localhost>]

>Number:         44196
>Category:       kern
>Synopsis:       possible mbuf leak when writing to BPF with BIOCSFEEDBACK
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 06 05:45:00 +0000 2010
>Originator:     Takahiro HAYASHI
>Release:        NetBSD-current 5.99.41
>Organization:
>Environment:
System: NetBSD halt 5.99.41 NetBSD 5.99.41 (HALT) #0: Fri Dec 3 22:48:54 JST 
2010 root@halt:/usr/build2/obj.i386/sys/arch/i386/compile/HALT i386
Architecture: i386
Machine: i386
>Description:
        Writing to BIOCSFEEDBACK enabled BPF descriptor may cause mbuf
        leak under particular condition e.g. interface is down.

        Please see below patch (inspired from FreeBSD).
        In bpf_write() of sys/net/bpf.c the packet is sent by if_output
        and return value is stored in `error'.  If error != 0,
        duplicated mbuf `mc' is not sent to upper layer and not freed.
        This causes mbuf leakage.

Index: sys/net/bpf.c
===================================================================
RCS file: /cvsroot/src/sys/net/bpf.c,v
retrieving revision 1.158
diff -u -c -r1.158 bpf.c
*** sys/net/bpf.c       14 Apr 2010 13:31:33 -0000      1.158
--- sys/net/bpf.c       6 Dec 2010 01:53:25 -0000
***************
*** 674,681 ****
        error = (*ifp->if_output)(ifp, m, (struct sockaddr *) &dst, NULL);
  
        if (mc != NULL) {
                if (error == 0)
                        (*ifp->if_input)(ifp, mc);
!       } else
!               m_freem(mc);
        splx(s);
        KERNEL_UNLOCK_ONE(NULL);
        /*
--- 676,684 ----
        error = (*ifp->if_output)(ifp, m, (struct sockaddr *) &dst, NULL);
  
        if (mc != NULL) {
                if (error == 0)
                        (*ifp->if_input)(ifp, mc);
!               else
!                       m_freem(mc);
!       }
        splx(s);
        KERNEL_UNLOCK_ONE(NULL);
        /*
>How-To-Repeat:
>Fix:
        see above.

-- 
Takahiro HAYASHI <hash at abox3 dot so-net dot ne dot jp>