Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 10 Aug 2019 00:01:26 +0000 (UTC)
From:      "Jonathan T. Looney" <jtl@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r350828 - stable/12/sys/kern
Message-ID:  <201908100001.x7A01QmQ066510@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: jtl
Date: Sat Aug 10 00:01:25 2019
New Revision: 350828
URL: https://svnweb.freebsd.org/changeset/base/350828

Log:
  MFC r350815:
    In m_pulldown(), before trying to prepend bytes to the subsequent mbuf,
    ensure that the subsequent mbuf contains the remainder of the bytes
    the caller sought. If this is not the case, fall through to the code
    which gathers the bytes in a new mbuf.
  
    This fixes a bug where m_pulldown() could fail to gather all the desired
    bytes into consecutive memory.
  
  PR:		238787
  Approved by:	so (emaste)

Modified:
  stable/12/sys/kern/uipc_mbuf2.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/kern/uipc_mbuf2.c
==============================================================================
--- stable/12/sys/kern/uipc_mbuf2.c	Fri Aug  9 23:50:57 2019	(r350827)
+++ stable/12/sys/kern/uipc_mbuf2.c	Sat Aug 10 00:01:25 2019	(r350828)
@@ -216,7 +216,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp
 		goto ok;
 	}
 	if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
-	 && writable) {
+	 && writable && n->m_next->m_len >= tlen) {
 		n->m_next->m_data -= hlen;
 		n->m_next->m_len += hlen;
 		bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201908100001.x7A01QmQ066510>