Date: Tue, 21 Apr 2009 19:14:13 +0000 (UTC) From: Maksim Yevmenkin <emax@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r191366 - head/sys/kern Message-ID: <200904211914.n3LJEDTx019389@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emax Date: Tue Apr 21 19:14:13 2009 New Revision: 191366 URL: http://svn.freebsd.org/changeset/base/191366 Log: Fix sbappendrecord_locked(). The main problem is that sbappendrecord_locked() relies on sbcompress() to set sb_mbtail. This will not happen if sbappendrecord_locked() is called with mbuf chain made of exactly one mbuf (i.e. m0->m_next == NULL). In this case sbcompress() will be called with m == NULL and will do nothing. I'm not entirely sure if m == NULL is a valid argument for sbcompress(), and, it rather pointless to call it like that, but keep calling it so it can do SBLASTMBUFCHK(). The problem is triggered by the SOCKBUF_DEBUG kernel option that enables SBLASTRECORDCHK() and SBLASTMBUFCHK() checks. PR: kern/126742 Investigated by: pluknet < pluknet -at- gmail -dot- com > No response from: freebsd-current@, freebsd-bluetooth@ MFC after: 3 days Modified: head/sys/kern/uipc_sockbuf.c Modified: head/sys/kern/uipc_sockbuf.c ============================================================================== --- head/sys/kern/uipc_sockbuf.c Tue Apr 21 19:06:47 2009 (r191365) +++ head/sys/kern/uipc_sockbuf.c Tue Apr 21 19:14:13 2009 (r191366) @@ -577,10 +577,6 @@ sbappendrecord_locked(struct sockbuf *sb if (m0 == 0) return; - m = sb->sb_mb; - if (m) - while (m->m_nextpkt) - m = m->m_nextpkt; /* * Put the first mbuf on the queue. Note this permits zero length * records. @@ -588,16 +584,14 @@ sbappendrecord_locked(struct sockbuf *sb sballoc(sb, m0); SBLASTRECORDCHK(sb); SBLINKRECORD(sb, m0); - if (m) - m->m_nextpkt = m0; - else - sb->sb_mb = m0; + sb->sb_mbtail = m0; m = m0->m_next; m0->m_next = 0; if (m && (m0->m_flags & M_EOR)) { m0->m_flags &= ~M_EOR; m->m_flags |= M_EOR; } + /* always call sbcompress() so it can do SBLASTMBUFCHK() */ sbcompress(sb, m, m0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200904211914.n3LJEDTx019389>