d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When a previous call to sbsndptr() leaves sb->sb_sndptroff at the start of an

Browse Source 
mbuf that was fully consumed by the previous call, the mbuf ptr returned by the
current call ends up being the previous mbuf in the sb chain to the one that
contains the data we want.

This does not cause any observable issues because the mbuf copy routines happily
walk the mbuf chain to get to the data at the moff offset, which in this case
means they effectively skip over the mbuf returned by sbsndptr().

We can't adjust sb->sb_sndptr during the previous call for this case because the
next mbuf in the chain may not exist yet. We therefore need to detect the
condition and make the adjustment during the current call.

Fix by detecting the special case of moff being at the start of the next mbuf in
the chain and adjust the required accounting variables accordingly.

Reviewed by:	andre
MFC after:	2 weeks
This commit is contained in:
Lawrence Stewart 2013-06-19 03:08:01 +00:00
parent 8aaf680e90
commit 0963c8e431
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=251984
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/uipc_sockbuf.c
View File

@ -942,6 +942,13 @@ sbsndptr(struct sockbuf *sb, u_int off, u_int len, u_int *moff)
/* Return closest mbuf in chain for current offset. */
*moff = off - sb->sb_sndptroff;
m = ret = sb->sb_sndptr ? sb->sb_sndptr : sb->sb_mb;
if (*moff == m->m_len) {
*moff = 0;
sb->sb_sndptroff += m->m_len;
m = ret = m->m_next;
KASSERT(ret->m_len > 0,
("mbuf %p in sockbuf %p chain has no valid data", ret, sb));
}
/* Advance by len to be as close as possible for the next transmit. */
for (off = off - sb->sb_sndptroff + len - 1;