aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2010-07-13 02:45:17 +0000
committerColin Percival <cperciva@FreeBSD.org>2010-07-13 02:45:17 +0000
commit8244752809859bd1bccd5319039743614fda46e6 (patch)
tree98f0145612c400d41c27ddf3ff1f0c0e5d80a378
parent24a6124130a2ab052de38fbcac566249baee6042 (diff)
downloadsrc-8244752809859bd1bccd5319039743614fda46e6.tar.gz
src-8244752809859bd1bccd5319039743614fda46e6.zip
Correctly copy the M_RDONLY flag when duplicating a reference
to an mbuf external buffer. Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-10:07.mbuf
Notes
Notes: svn path=/releng/7.1/; revision=209964
-rw-r--r--UPDATING4
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/kern/uipc_mbuf.c1
3 files changed, 6 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index b4e0075189d5..cf50259626e6 100644
--- a/UPDATING
+++ b/UPDATING
@@ -8,6 +8,10 @@ Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running
portupgrade.
+20100713: p13 FreeBSD-SA-10:07.mbuf
+ Correctly copy the M_RDONLY flag when duplicating a reference
+ to an mbuf external buffer.
+
20100526: p12 FreeBSD-SA-10:05.opie
Fix a one-NUL-byte buffer overflow in libopie. [10:05]
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 614abb243b5d..4838401d220f 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="7.1"
-BRANCH="RELEASE-p12"
+BRANCH="RELEASE-p13"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index f8f38a0556f6..4a16deed1df7 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -301,6 +301,7 @@ mb_dupcl(struct mbuf *n, struct mbuf *m)
n->m_ext.ref_cnt = m->m_ext.ref_cnt;
n->m_ext.ext_type = m->m_ext.ext_type;
n->m_flags |= M_EXT;
+ n->m_flags |= m->m_flags & M_RDONLY;
}
/*