Date: Sat, 10 Aug 2019 00:01:26 +0000 (UTC) From: "Jonathan T. Looney" <jtl@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r350828 - stable/12/sys/kern Message-ID: <201908100001.x7A01QmQ066510@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jtl Date: Sat Aug 10 00:01:25 2019 New Revision: 350828 URL: https://svnweb.freebsd.org/changeset/base/350828 Log: MFC r350815: In m_pulldown(), before trying to prepend bytes to the subsequent mbuf, ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Approved by: so (emaste) Modified: stable/12/sys/kern/uipc_mbuf2.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/kern/uipc_mbuf2.c ============================================================================== --- stable/12/sys/kern/uipc_mbuf2.c Fri Aug 9 23:50:57 2019 (r350827) +++ stable/12/sys/kern/uipc_mbuf2.c Sat Aug 10 00:01:25 2019 (r350828) @@ -216,7 +216,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp goto ok; } if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen - && writable) { + && writable && n->m_next->m_len >= tlen) { n->m_next->m_data -= hlen; n->m_next->m_len += hlen; bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201908100001.x7A01QmQ066510>