Date: Thu, 30 Jul 2026 12:50:05 +0000 From: John Baldwin <jhb@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: KUROSAWA Takahiro <takahiro.kurosawa@gmail.com> Subject: git: 25165e4499e1 - main - mbuf: Make m_unshare() fail on KTLS mbufs Message-ID: <6a6b487d.43a67.2dba668b@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=25165e4499e17f4f75fcf7fe7691fc7f865d4015 commit 25165e4499e17f4f75fcf7fe7691fc7f865d4015 Author: KUROSAWA Takahiro <takahiro.kurosawa@gmail.com> AuthorDate: 2026-07-30 12:30:03 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-07-30 12:30:25 +0000 mbuf: Make m_unshare() fail on KTLS mbufs Commit f2202ab5abda did not account for KTLS mbufs. m_unshare() tries to linearize the original mbuf chain and creates a writable copy of it, converting unmapped mbufs. Both of them are unsafe for KTLS mbufs. It is better to return NULL if the mbuf chain contains a KTLS mbuf. Reported by: jhb Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D58466 --- sys/kern/uipc_mbuf.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index ffdd115e3e0a..3f7841721a86 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -2147,6 +2147,15 @@ m_unshare(struct mbuf *m0, int how) mprev = NULL; for (m = m0; m != NULL; m = mprev->m_next) { + /* + * m_unshare() can not process KTLS mbufs because they must + * neither be linearized nor converted to mapped. + */ + if (mbuf_has_tls_session(m)) { + m_freem(m0); + return (NULL); + } + /* * Regular mbufs are ignored unless there's a cluster * in front of it that we can use to coalesce. We dohome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a6b487d.43a67.2dba668b>