From cbd3563b7ab3f97387ffe6953e89223227e5098b Mon Sep 17 00:00:00 2001
From: hantwofish <hankangkang5@huawei.com>
Date: Thu, 9 May 2024 14:50:52 +0800
Subject: [PATCH] Fix MBUF memory leakage issue when message length is greater
 than MTU

(cherry picked from commit f82e0df44108578caa929cda16103e231531c9e3)
---
 0132-mod-udp-loop-mem-leak.patch | 79 ++++++++++++++++++++++++++++++++
 lwip.spec                        |  4 ++
 2 files changed, 83 insertions(+)
 create mode 100644 0132-mod-udp-loop-mem-leak.patch

diff --git a/0132-mod-udp-loop-mem-leak.patch b/0132-mod-udp-loop-mem-leak.patch
new file mode 100644
index 0000000..7f930dc
--- /dev/null
+++ b/0132-mod-udp-loop-mem-leak.patch
@@ -0,0 +1,79 @@
+From 817a3b938db89efa8ef63d610b43cb10321da446 Mon Sep 17 00:00:00 2001
+From: hantwofish <hankangkang5@huawei.com>
+Date: Tue, 7 May 2024 17:49:32 +0800
+Subject: [PATCH] mod udp loop mem leak
+
+---
+ src/core/netif.c | 21 +++++++++++++++------
+ src/core/pbuf.c  | 20 +++++++++++++++++---
+ 2 files changed, 32 insertions(+), 9 deletions(-)
+
+diff --git a/src/core/netif.c b/src/core/netif.c
+index 2fc8945..e6cdebe 100644
+--- a/src/core/netif.c
++++ b/src/core/netif.c
+@@ -1182,13 +1182,22 @@ udp_netif_loop_output(struct netif *netif, struct pbuf *p)
+   LWIP_ASSERT("netif_loop_output: invalid pbuf", p != NULL);
+ 
+   /* Allocate a new pbuf */
+-  r = pbuf_alloc(PBUF_LINK, p->tot_len, PBUF_RAM);
+-  if (r == NULL) {
+-    LINK_STATS_INC(link.memerr);
+-    LINK_STATS_INC(link.drop);
+-    MIB2_STATS_NETIF_INC(stats_if, ifoutdiscards);
+-    return ERR_MEM;
++  u16_t p_clen = pbuf_clen(p);
++  struct pbuf *temp[p_clen];
++  for (int i = 0; i < p_clen; i++) {
++      temp[i] = pbuf_alloc(PBUF_LINK, p->len, PBUF_RAM);
++      if (temp[i] == NULL) {
++          LINK_STATS_INC(link.memerr);
++          LINK_STATS_INC(link.drop);
++          MIB2_STATS_NETIF_INC(stats_if, ifoutdiscards);
++          pbuf_free(temp[0]);
++          return ERR_MEM;
++      }
++      if (i > 0) {
++          pbuf_cat(temp[0], temp[i]);
++      }
+   }
++  r = temp[0];
+ #if LWIP_LOOPBACK_MAX_PBUFS
+   clen = pbuf_clen(r);
+   /* check for overflow or too many pbuf on queue */
+diff --git a/src/core/pbuf.c b/src/core/pbuf.c
+index b0a63b4..914d1f4 100644
+--- a/src/core/pbuf.c
++++ b/src/core/pbuf.c
+@@ -1373,11 +1373,25 @@ pbuf_clone(pbuf_layer layer, pbuf_type type, struct pbuf *p)
+ {
+   struct pbuf *q;
+   err_t err;
+-  q = pbuf_alloc(layer, p->tot_len, type);
+-  if (q == NULL) {
+-    return NULL;
++  u16_t p_clen = pbuf_clen(p);
++  struct pbuf *temp[p_clen];
++  for (int i = 0; i < p_clen; i++) {
++      temp[i] = pbuf_alloc(PBUF_LINK, p->len, PBUF_RAM);
++      if (temp[i] == NULL) {
++          pbuf_free(temp[0]);
++          return NULL;
++      }
++      if (i > 0) {
++          pbuf_cat(temp[0], temp[i]);
++      }
+   }
++  q = temp[0];
++
+   err = pbuf_copy(q, p);
++  if (err != ERR_OK) {
++      pbuf_free(q);
++      return NULL;
++  }
+   LWIP_UNUSED_ARG(err); /* in case of LWIP_NOASSERT */
+   LWIP_ASSERT("pbuf_copy failed", err == ERR_OK);
+   return q;
+-- 
+2.33.0
+
diff --git a/lwip.spec b/lwip.spec
index 8ac348c..612122b 100644
--- a/lwip.spec
+++ b/lwip.spec
@@ -143,6 +143,7 @@ Patch9127:  0128-add-MCAST_JOIN_SOURCE_GROUP-to-setsockopt-for-igmpv3.patch
 Patch9128:  0129-memset-gazelle_quintuple-in-vdev_reg_done.patch
 Patch9129:  0130-add-MCAST_JOIN_GROUP-to-setsockopt-for-igmpv3.patch
 Patch9130:  0131-add-MCAST_BLOCK_SOURCE-to-setsockopt-for-igmpv3.patch
+Patch9131:  0132-mod-udp-loop-mem-leak.patch
 
 BuildRequires: gcc-c++ dos2unix dpdk-devel
 
@@ -172,6 +173,9 @@ cd %{_builddir}/%{name}-%{version}/src
 %{_libdir}/liblwip.a
 
 %changelog
+* Tue May 07 2024 hankangkang <hankangkang5@huawei.com> - 2.2.0-25
+- Fix MBUF memory leakage issue when message length is greater than MTU
+
 * Tue May 07 2024 zhangyulong <zhangyulong@kylinos.cn> - 2.2.0-24
 - add option MCAST_BLOCK_SOURCE to the setsockopt for the igmpv3 protocol