Date: Fri, 9 Aug 2019 05:19:00 +0000 (UTC) From: "Jonathan T. Looney" <jtl@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r350815 - head/sys/kern Message-ID: <201908090519.x795J0q0096491@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jtl Date: Fri Aug 9 05:18:59 2019 New Revision: 350815 URL: https://svnweb.freebsd.org/changeset/base/350815 Log: In m_pulldown(), before trying to prepend bytes to the subsequent mbuf, ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Reported by: A reddit user Discussed with: emaste Obtained from: NetBSD MFC after: 3 days Modified: head/sys/kern/uipc_mbuf2.c Modified: head/sys/kern/uipc_mbuf2.c ============================================================================== --- head/sys/kern/uipc_mbuf2.c Fri Aug 9 02:20:26 2019 (r350814) +++ head/sys/kern/uipc_mbuf2.c Fri Aug 9 05:18:59 2019 (r350815) @@ -216,7 +216,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp goto ok; } if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen - && writable) { + && writable && n->m_next->m_len >= tlen) { n->m_next->m_data -= hlen; n->m_next->m_len += hlen; bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201908090519.x795J0q0096491>