path: root/sys
diff options
authorJonathan T. Looney <jtl@FreeBSD.org>2019-08-09 05:18:59 +0000
committerJonathan T. Looney <jtl@FreeBSD.org>2019-08-09 05:18:59 +0000
commitafd959f33292cb63aa784c221e5f62add2b21eed (patch)
tree87c8313f85fba506656530b458b666825ed3974e /sys
parent3447ea90d74b5cedc84ae2eb4d74cfe16e966017 (diff)
In m_pulldown(), before trying to prepend bytes to the subsequent mbuf,
ensure that the subsequent mbuf contains the remainder of the bytes the caller sought. If this is not the case, fall through to the code which gathers the bytes in a new mbuf. This fixes a bug where m_pulldown() could fail to gather all the desired bytes into consecutive memory. PR: 238787 Reported by: A reddit user Discussed with: emaste Obtained from: NetBSD MFC after: 3 days
Notes: svn path=/head/; revision=350815
Diffstat (limited to 'sys')
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/kern/uipc_mbuf2.c b/sys/kern/uipc_mbuf2.c
index 41f75f6e6dba..36c39ef34fbb 100644
--- a/sys/kern/uipc_mbuf2.c
+++ b/sys/kern/uipc_mbuf2.c
@@ -216,7 +216,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp)
goto ok;
if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
- && writable) {
+ && writable && n->m_next->m_len >= tlen) {
n->m_next->m_data -= hlen;
n->m_next->m_len += hlen;
bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);