From owner-freebsd-hackers  Fri Aug  2 06:54:33 1996
Return-Path: owner-hackers
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id GAA08025
          for hackers-outgoing; Fri, 2 Aug 1996 06:54:33 -0700 (PDT)
Received: from rah.star-gate.com (rah.star-gate.com [204.188.121.18])
          by freefall.freebsd.org (8.7.5/8.7.3) with ESMTP id GAA07999
          for <hackers@freebsd.org>; Fri, 2 Aug 1996 06:54:29 -0700 (PDT)
Received: from rah.star-gate.com (localhost.v-site.net [127.0.0.1]) by rah.star-gate.com (8.7.5/8.7.3) with ESMTP id GAA00394 for <hackers@freebsd.org>; Fri, 2 Aug 1996 06:54:28 -0700 (PDT)
Message-Id: <199608021354.GAA00394@rah.star-gate.com>
X-Mailer: exmh version 1.6.5 12/11/95
To: hackers@freebsd.org
Subject: m_copym crash
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 02 Aug 1996 06:54:27 -0700
From: Amancio Hasty <hasty@rah.star-gate.com>
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk



I have a tcl script crashing my system here at the close of a tcp
connection.

Basically, when the file gets close and it calls a series of 
tcp close related functions, the system crashes at "m_copym 3"

Has anyone seen this before on -current?

	Tnks,
	Amancio

----

struct mbuf *
m_copym(m, off0, len, wait)
	register struct mbuf *m;
	int off0, wait;
	register int len;
{
	register struct mbuf *n, **np;
	register int off = off0;
	struct mbuf *top;
	int copyhdr = 0;

	if (off < 0 || len < 0)
		panic("m_copym 1");
	if (off == 0 && m->m_flags & M_PKTHDR)
		copyhdr = 1;
	while (off > 0) {
		if (m == 0)
			panic("m_copym 2");
		if (off < m->m_len)
			break;
		off -= m->m_len;
		m = m->m_next;
	}
	np = &top;
	top = 0;
	while (len > 0) {
		if (m == 0) {
			if (len != M_COPYALL)
				panic("m_copym 3");
			   **** crash site *****
			break;
		}