mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-27 16:39:08 +00:00
Code Issues Releases Activity

Fix sbappendrecord_locked().

Browse Source 
The main problem is that sbappendrecord_locked() relies on sbcompress()
to set sb_mbtail. This will not happen if sbappendrecord_locked() is
called with mbuf chain made of exactly one mbuf (i.e. m0->m_next == NULL).
In this case sbcompress() will be called with m == NULL and will do
nothing. I'm not entirely sure if m == NULL is a valid argument for
sbcompress(), and, it rather pointless to call it like that, but keep
calling it so it can do SBLASTMBUFCHK().

The problem is triggered by the SOCKBUF_DEBUG kernel option that
enables SBLASTRECORDCHK() and SBLASTMBUFCHK() checks.

PR:			kern/126742
Investigated by:	pluknet < pluknet -at- gmail -dot- com >
No response from:	freebsd-current@, freebsd-bluetooth@
MFC after:		3 days
This commit is contained in:
Maksim Yevmenkin 2009-04-21 19:14:13 +00:00
parent ab5ed8a5aa
commit e72a94adc3
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=191366
1 changed files with 2 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/kern/uipc_sockbuf.c
View File

@ -577,10 +577,6 @@ sbappendrecord_locked(struct sockbuf *sb, struct mbuf *m0)
if (m0 == 0)
return;
m = sb->sb_mb;
if (m)
while (m->m_nextpkt)
m = m->m_nextpkt;
/*
* Put the first mbuf on the queue. Note this permits zero length
* records.
@ -588,16 +584,14 @@ sbappendrecord_locked(struct sockbuf *sb, struct mbuf *m0)
sballoc(sb, m0);
SBLASTRECORDCHK(sb);
SBLINKRECORD(sb, m0);
if (m)
m->m_nextpkt = m0;
else
sb->sb_mb = m0;
sb->sb_mbtail = m0;
m = m0->m_next;
m0->m_next = 0;
if (m && (m0->m_flags & M_EOR)) {
m0->m_flags &= ~M_EOR;
m->m_flags |= M_EOR;
}
/* always call sbcompress() so it can do SBLASTMBUFCHK() */
sbcompress(sb, m, m0);
}