From owner-svn-src-all@FreeBSD.ORG Mon Feb 23 14:41:29 2015 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B7DD35A0; Mon, 23 Feb 2015 14:41:29 +0000 (UTC) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 28633CD7; Mon, 23 Feb 2015 14:41:28 +0000 (UTC) Received: from tom.home (kostik@localhost [127.0.0.1]) by kib.kiev.ua (8.14.9/8.14.9) with ESMTP id t1NEfNqK039034 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 23 Feb 2015 16:41:23 +0200 (EET) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.9.2 kib.kiev.ua t1NEfNqK039034 Received: (from kostik@localhost) by tom.home (8.14.9/8.14.9/Submit) id t1NEfMhA039033; Mon, 23 Feb 2015 16:41:22 +0200 (EET) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Mon, 23 Feb 2015 16:41:22 +0200 From: Konstantin Belousov To: "Andrey V. Elsukov" Subject: Re: svn commit: r279206 - head/sys/kern Message-ID: <20150223144122.GP74514@kib.kiev.ua> References: <201502231341.t1NDfaPh029088@svn.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201502231341.t1NDfaPh029088@svn.freebsd.org> User-Agent: Mutt/1.5.23 (2014-03-12) X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on tom.home Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Feb 2015 14:41:29 -0000 On Mon, Feb 23, 2015 at 01:41:36PM +0000, Andrey V. Elsukov wrote: > Author: ae > Date: Mon Feb 23 13:41:35 2015 > New Revision: 279206 > URL: https://svnweb.freebsd.org/changeset/base/279206 > > Log: > In some cases soreceive_dgram() can return no data, but has control > message. This can happen when application is sending packets too big > for the path MTU and recvmsg() will return zero (indicating no data) > but there will be a cmsghdr with cmsg_type set to IPV6_PATHMTU. > Remove KASSERT() which does NULL pointer dereference in such case. > Also call m_freem() only when m isn't NULL. > > PR: 197882 > MFC after: 1 week > Sponsored by: Yandex LLC > > Modified: > head/sys/kern/uipc_socket.c > > Modified: head/sys/kern/uipc_socket.c > ============================================================================== > --- head/sys/kern/uipc_socket.c Mon Feb 23 12:54:46 2015 (r279205) > +++ head/sys/kern/uipc_socket.c Mon Feb 23 13:41:35 2015 (r279206) > @@ -2255,7 +2255,8 @@ soreceive_dgram(struct socket *so, struc > * Process one or more MT_CONTROL mbufs present before any data mbufs > * in the first mbuf chain on the socket buffer. We call into the > * protocol to perform externalization (or freeing if controlp == > - * NULL). > + * NULL). In some cases there can be only MT_CONTROL mbufs without > + * MT_DATA mbufs. > */ > if (m->m_type == MT_CONTROL) { > struct mbuf *cm = NULL, *cmn; > @@ -2285,8 +2286,6 @@ soreceive_dgram(struct socket *so, struc > cm = cmn; > } > } > - KASSERT(m->m_type == MT_DATA, ("soreceive_dgram: !data")); > - Should this be changed to m == NULL || m->m_type == MT_DATA ? > while (m != NULL && uio->uio_resid > 0) { > len = uio->uio_resid; > if (len > m->m_len) > @@ -2303,9 +2302,10 @@ soreceive_dgram(struct socket *so, struc > m->m_len -= len; > } > } > - if (m != NULL) > + if (m != NULL) { > flags |= MSG_TRUNC; > - m_freem(m); > + m_freem(m); > + } > if (flagsp != NULL) > *flagsp |= flags; > return (0);