From ec14518eb5671f4b4d6326690e2dd3db562282b8 Mon Sep 17 00:00:00 2001 From: dlg Date: Sat, 9 May 2026 01:47:12 +0000 Subject: [PATCH] avoid leaking memory when mbuf chain allocations fail in tun_dev_write() the mbufs built by tun_dev_write used to be limited to a single mbuf and cluster, but has grown in complexity now that it supports tun_hdr and tso, which required building mbuf chains. some of the error handling when allocating mbuf bits wasnt adapted to free the preceding chain when later allocaitons failed, resulting in a memory leak. reported by frank denis --- sys/net/if_tun.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c index 2dcdda1bb1f..116933571ea 100644 --- a/sys/net/if_tun.c +++ b/sys/net/if_tun.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_tun.c,v 1.256 2025/12/14 01:51:26 dlg Exp $ */ +/* $OpenBSD: if_tun.c,v 1.257 2026/05/09 01:47:12 dlg Exp $ */ /* $NetBSD: if_tun.c,v 1.24 1996/05/07 02:40:48 thorpej Exp $ */ /* @@ -1009,7 +1009,7 @@ tun_dev_write(dev_t dev, struct uio *uio, int ioflag, int align) m_clget(m, M_DONTWAIT, alen); if (!ISSET(m->m_flags, M_EXT)) { error = ENOMEM; - goto put; + goto drop; } } @@ -1031,7 +1031,7 @@ tun_dev_write(dev_t dev, struct uio *uio, int ioflag, int align) n = m_get(M_DONTWAIT, MT_DATA); if (n == NULL) { error = ENOMEM; - goto put; + goto drop; } align = 0;