From owner-svn-src-stable@freebsd.org  Tue Oct  4 22:15:43 2016
Return-Path: <owner-svn-src-stable@freebsd.org>
Delivered-To: svn-src-stable@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 28630AF58F9;
 Tue,  4 Oct 2016 22:15:43 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id EED12C3D;
 Tue,  4 Oct 2016 22:15:42 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u94MFgYi083676;
 Tue, 4 Oct 2016 22:15:42 GMT (envelope-from jhb@FreeBSD.org)
Received: (from jhb@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id u94MFgeR083675;
 Tue, 4 Oct 2016 22:15:42 GMT (envelope-from jhb@FreeBSD.org)
Message-Id: <201610042215.u94MFgeR083675@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: jhb set sender to jhb@FreeBSD.org
 using -f
From: John Baldwin <jhb@FreeBSD.org>
Date: Tue, 4 Oct 2016 22:15:42 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject: svn commit: r306690 - stable/11/sys/dev/cxgbe
X-SVN-Group: stable-11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-stable@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: SVN commit messages for all the -stable branches of the src tree
 <svn-src-stable.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-stable>, 
 <mailto:svn-src-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable/>
List-Post: <mailto:svn-src-stable@freebsd.org>
List-Help: <mailto:svn-src-stable-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-stable>,
 <mailto:svn-src-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 04 Oct 2016 22:15:43 -0000

Author: jhb
Date: Tue Oct  4 22:15:42 2016
New Revision: 306690
URL: https://svnweb.freebsd.org/changeset/base/306690

Log:
  MFC 305548: Don't break out of the m_advance() loop if len drops to zero.
  
  If a packet contains the Ethernet header (14 bytes) in the first mbuf
  and the payload (IP + UDP + data) in the second mbuf, then the attempt
  to fetch the l3hdr will return a NULL pointer.  The first loop iteration
  will drop len to zero and exit the loop without setting 'p'.  However,
  the desired data is at the start of the second mbuf, so the correct
  behavior is to loop around and let the conditional set 'p' to m_data of
  the next mbuf (and leave offset as 0).

Modified:
  stable/11/sys/dev/cxgbe/t4_sge.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/cxgbe/t4_sge.c
==============================================================================
--- stable/11/sys/dev/cxgbe/t4_sge.c	Tue Oct  4 21:44:20 2016	(r306689)
+++ stable/11/sys/dev/cxgbe/t4_sge.c	Tue Oct  4 22:15:42 2016	(r306690)
@@ -2081,7 +2081,7 @@ m_advance(struct mbuf **pm, int *poffset
 
 	MPASS(len > 0);
 
-	while (len) {
+	for (;;) {
 		if (offset + len < m->m_len) {
 			offset += len;
 			p = mtod(m, uintptr_t) + offset;