⬢ DragonFlyBSD Kernel Audit
DF-4111 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/tl/if_tl.c
+++ b/sys/dev/netif/tl/if_tl.c
@@ -1853,7 +1880,18 @@
 		cur_tx->tl_next = NULL;
 
 		/* Pack the data into the list. */
-		tl_encap(sc, cur_tx, m_head);
+		if (tl_encap(sc, cur_tx, m_head) != 0) {
+			/*
+			 * tl_encap failed (cluster collapse OOM): it freed
+			 * nothing and armed nothing.  Drop the packet and
+			 * return the chain entry instead of chaining a
+			 * non-READY list and tapping a NULL mbuf into BPF.
+			 */
+			m_freem(m_head);
+			cur_tx->tl_next = sc->tl_cdata.tl_tx_free;
+			sc->tl_cdata.tl_tx_free = cur_tx;
+			continue;
+		}
 
 		/* Chain it together */
 		if (prev != NULL) {