mbuf: Make m_unshare() fail on KTLS mbufs

Commit f2202ab5abda did not account for  KTLS mbufs.

m_unshare() tries to linearize the original mbuf chain and creates a
writable copy of it, converting unmapped mbufs.  Both of them are
unsafe for KTLS mbufs.

It is better to return NULL if the mbuf chain contains a KTLS mbuf.

Reported by:	jhb
Reviewed by:	jhb
Differential Revision:	https://reviews.freebsd.org/D58466

1 files changed, 9 insertions, 0 deletions

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index ffdd115e3e0a..3f7841721a86 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -2148,6 +2148,15 @@ m_unshare(struct mbuf *m0, int how)
 	mprev = NULL;
 	for (m = m0; m != NULL; m = mprev->m_next) {
 		/*
+		 * m_unshare() can not process KTLS mbufs because they must
+		 * neither be linearized nor converted to mapped.
+		 */
+		if (mbuf_has_tls_session(m)) {
+			m_freem(m0);
+			return (NULL);
+		}
+
+		/*
 		 * Regular mbufs are ignored unless there's a cluster
 		 * in front of it that we can use to coalesce.  We do
 		 * the latter mainly so later clusters can be coalesced