DF-4082 — oce_tx returns 0 (success) when oce_insert_vlan_tag fails: mbuf

leaked and packet silently dropped while the caller believes it was sent

File: sys/dev/netif/oce/oce_if.c (pass 2) Class: error-path logic bug (memory leak + silent drop)

Root cause

oce_tx() (sys/dev/netif/oce/oce_if.c):

if (oce_tx_asic_stall_verify(sc, m)) {          /* 833 */
    m = oce_insert_vlan_tag(sc, m, &complete);/* 834 */
    if (!m) {
        device_printf(sc->dev, "Insertion unsuccessful\n");
        return 0;                        /* 837 — SUCCESS! */
    }
}

oce_insert_vlan_tag (oce_if.c:2202-2236) returns NULL exactly when !M_WRITABLE(m) (2207-2208) — i.e. read-only external mbufs (M_EXT with a non-standard free/readonly mapping, e.g. sendfile-style or otherwise EXT_RDONLY chains).

On that path: - *mpp is left untouched (still the original mbuf), - the WQ/pckts state is untouched, - the function returns 0 = success.

Caller oce_start_locked (oce_if.c:1129-1147): rc == 0 → BPF tap (1144-1145) → loop continues → the dequeued mbuf is never freed and never transmitted. Per-packet mbuf(+cluster) leak plus silent loss, with a false success return.

Gating (narrow): needs oce_tx_asic_stall_verify == TRUE, i.e. BE3 rev A1 (asic_revision < 2, oce_if.c:2193-2200) AND QnQ/UMC mode (pvid/qnqid set, oce_if.h:1162-1163) AND an IPv6 packet with extension headers (oce_check_ipv6_ext_hdr, oce_if.c:2167-2191) AND a read-only mbuf. Extremely narrow hardware profile — hence Low severity — but the error-path logic is plainly wrong.

Fix

Return an error and let the caller free/requeue, or free locally:

        if (!m) {
            device_printf(sc->dev, "Insertion unsuccessful\n");
-           return 0;
+           return ENOBUFS;   /* caller frees *mpp */
        }

(ENXIO/ENOMEM both work with oce_start_locked's handling at 1135-1142 — with m != NULL it prepends back to the ifq instead of leaking.)

Verification status

UNTESTED — hardware-gated (BE3-A1 + UMC/QnQ profile cannot be present in QEMU).

DF-4082 VERDICT — oce_tx vlan-insert failure returns success

Status: UNTESTED (hardware-gated; logic is source-certain)

Trace:

1. oce_if.c:833-840: on oce_tx_asic_stall_verify() TRUE, oce_insert_vlan_tag() failure (NULL) prints and return 0;.
2. oce_if.c:2207-2208: NULL return iff !M_WRITABLE(m).
3. oce_if.c:1134-1145: oce_start_locked treats rc==0 as delivered: BPF tap, next dequeue. The mbuf (still valid, still owned by the ifq-dequeued chain) is never freed — leak — and the packet never reaches the WQ.

Trigger conditions stack: is_be3_a1 (BE3, asic_revision<2) && IS_QNQ_OR_UMC && ipv6 ext-hdr packet && read-only mbuf chain. All hardware/config gated except the read-only-mbuf input, which the socket layer can produce. No QEMU emulation of the NIC → untestable here; severity Low on trigger narrowness (Info-adjacent), but the code defect is unambiguous and the fix is one line.

Impact ceiling: unbounded mbuf/cluster leak (memory exhaustion DoS) and silent packet loss on the affected profile, driven by ordinary IPv6 traffic.

Fix

Return an error (ENOBUFS) instead of 0 so oce_start_locked's error path (ifq_prepend at 1139) takes the mbuf back.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)