Don't use M_DUP_PKTHDR() in the driver bpf hook. Using M_DUP_PKTHDR() on a

static mbuf results in a mbuf tag memory leak. Same change as in rum(4).
OK mglocker@

4 files changed, 28 insertions, 20 deletions

diff --git a/sys/dev/usb/if_atu.c b/sys/dev/usb/if_atu.c
index d9be2e704b3..4d232706a48 100644
--- a/sys/dev/usb/if_atu.c
+++ b/sys/dev/usb/if_atu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_atu.c,v 1.78 2006/12/21 02:28:47 krw Exp $ */
+/*	$OpenBSD: if_atu.c,v 1.79 2007/01/02 14:43:50 claudio Exp $ */
 /*
  * Copyright (c) 2003, 2004
  *	Daan Vreeken <Danovitsch@Vitsch.net>.  All rights reserved.
@@ -1736,11 +1736,12 @@ atu_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 		rr->rr_rssi = h->rssi;
 		rr->rr_max_rssi = ic->ic_max_rssi;
 
-		M_DUP_PKTHDR(&mb, m);
 		mb.m_data = (caddr_t)rr;
 		mb.m_len = sizeof(sc->sc_txtapu);
 		mb.m_next = m;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_IN);
 	}
 #endif /* NPBFILTER > 0 */
@@ -1859,11 +1860,12 @@ atu_tx_start(struct atu_softc *sc, struct ieee80211_node *ni,
 		rt->rt_chan_flags =
 		    htole16(ic->ic_bss->ni_chan->ic_flags);
 
-		M_DUP_PKTHDR(&mb, m);
 		mb.m_data = (caddr_t)rt;
 		mb.m_len = sizeof(sc->sc_txtapu);
 		mb.m_next = m;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_radiobpf, &mb, BPF_DIRECTION_OUT);
 	}
 #endif
diff --git a/sys/dev/usb/if_ral.c b/sys/dev/usb/if_ral.c
index dd2faab4e4a..3e5da8453e6 100644
--- a/sys/dev/usb/if_ral.c
+++ b/sys/dev/usb/if_ral.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ral.c,v 1.87 2006/12/07 17:32:19 damien Exp $	*/
+/*	$OpenBSD: if_ral.c,v 1.88 2007/01/02 14:43:50 claudio Exp $	*/
 
 /*-
  * Copyright (c) 2005, 2006
@@ -781,11 +781,12 @@ ural_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 		tap->wr_antenna = sc->rx_ant;
 		tap->wr_antsignal = desc->rssi;
 
-		M_DUP_PKTHDR(&mb, m);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_rxtap_len;
 		mb.m_next = m;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
 	}
 #endif
@@ -1176,11 +1177,12 @@ ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 		tap->wt_antenna = sc->tx_ant;
 
-		M_DUP_PKTHDR(&mb, m0);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_txtap_len;
 		mb.m_next = m0;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
 	}
 #endif
diff --git a/sys/dev/usb/if_uath.c b/sys/dev/usb/if_uath.c
index 0425dad107b..b571847a136 100644
--- a/sys/dev/usb/if_uath.c
+++ b/sys/dev/usb/if_uath.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_uath.c,v 1.15 2006/12/16 15:32:05 damien Exp $	*/
+/*	$OpenBSD: if_uath.c,v 1.16 2007/01/02 14:43:50 claudio Exp $	*/
 
 /*-
  * Copyright (c) 2006
@@ -1275,11 +1275,12 @@ uath_data_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv,
 		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 		tap->wr_dbm_antsignal = (int8_t)betoh32(desc->rssi);
 
-		M_DUP_PKTHDR(&mb, m);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_rxtap_len;
 		mb.m_next = m;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
 	}
 #endif
@@ -1390,11 +1391,12 @@ uath_tx_data(struct uath_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 
-		M_DUP_PKTHDR(&mb, m0);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_txtap_len;
 		mb.m_next = m0;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
 	}
 #endif
diff --git a/sys/dev/usb/if_zyd.c b/sys/dev/usb/if_zyd.c
index 76b77852737..6274ad61616 100644
--- a/sys/dev/usb/if_zyd.c
+++ b/sys/dev/usb/if_zyd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_zyd.c,v 1.48 2006/12/16 15:35:47 damien Exp $	*/
+/*	$OpenBSD: if_zyd.c,v 1.49 2007/01/02 14:43:50 claudio Exp $	*/
 
 /*-
  * Copyright (c) 2006 by Damien Bergamini <damien.bergamini@free.fr>
@@ -1885,11 +1885,12 @@ zyd_rx_data(struct zyd_softc *sc, const uint8_t *buf, uint16_t len)
 		tap->wr_rssi = stat->rssi;
 		tap->wr_rate = rates[plcp->signal & 0xf];
 
-		M_DUP_PKTHDR(&mb, m);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_rxtap_len;
 		mb.m_next = m;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
 	}
 #endif
@@ -2108,11 +2109,12 @@ zyd_tx_data(struct zyd_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 
-		M_DUP_PKTHDR(&mb, m0);
 		mb.m_data = (caddr_t)tap;
 		mb.m_len = sc->sc_txtap_len;
 		mb.m_next = m0;
-		mb.m_pkthdr.len += mb.m_len;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
 	}
 #endif