From owner-freebsd-net Fri May 31 11:56:51 2002 Delivered-To: freebsd-net@freebsd.org Received: from iguana.icir.org (iguana.icir.org [192.150.187.36]) by hub.freebsd.org (Postfix) with ESMTP id D50CE37B404 for ; Fri, 31 May 2002 11:56:36 -0700 (PDT) Received: (from rizzo@localhost) by iguana.icir.org (8.11.6/8.11.3) id g4VIuZi46201; Fri, 31 May 2002 11:56:35 -0700 (PDT) (envelope-from rizzo) Date: Fri, 31 May 2002 11:56:35 -0700 From: Luigi Rizzo To: Archie Cobbs Cc: freebsd-net@FreeBSD.ORG Subject: Re: m_split() considered harmful Message-ID: <20020531115635.B45530@iguana.icir.org> References: <200205311829.g4VITKM01684@arch20m.dellroad.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <200205311829.g4VITKM01684@arch20m.dellroad.org>; from archie@dellroad.org on Fri, May 31, 2002 at 11:29:20AM -0700 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Fri, May 31, 2002 at 11:29:20AM -0700, Archie Cobbs wrote: ... if you add the additional Note, then it might be worthwhile that the writability of the returned buffer should be checked in the standard way (whatever macro it is, i forget the name). cheers luigi > > --- kern/uipc_mbuf.c.orig Fri May 31 11:17:52 2002 > +++ kern/uipc_mbuf.c Fri May 31 11:27:42 2002 > @@ -1194,6 +1194,10 @@ > * Partition an mbuf chain in two pieces, returning the tail -- > * all but the first len0 bytes. In case of failure, it returns NULL and > * attempts to restore the chain to its original state. > + * > + * Note that the returned mbuf must be treated as read-only, because > + * it will end up sharing an mbuf cluster with the original mbuf if the > + * "breaking point" happens to lie within a cluster mbuf. > */ > struct mbuf * > m_split(m0, len0, wait) > @@ -1247,7 +1251,6 @@ > else > (*(m->m_ext.ext_ref))(m->m_ext.ext_buf, > m->m_ext.ext_size); > - m->m_ext.ext_size = 0; /* For Accounting XXXXXX danger */ > n->m_data = m->m_data + len; > } else { > bcopy(mtod(m, caddr_t) + len, mtod(n, caddr_t), remain); > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-net" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message