From 53b680caa2896d058adf77da315aee92e36ac8dc Mon Sep 17 00:00:00 2001
From: Gleb Smirnoff <glebius@FreeBSD.org>
Date: Mon, 22 Dec 2014 15:39:24 +0000
Subject: [PATCH] In sbappend*() family of functions clear M_PROTO flags of
 incoming mbufs. sbappendstream() already does this in m_demote().

PR:		196174
Sponsored by:	Nginx, Inc.
---
 sys/kern/uipc_sockbuf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index acbccc9176ef..88952ed6629a 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -579,7 +579,7 @@ sbappend_locked(struct sockbuf *sb, struct mbuf *m)
 
 	if (m == 0)
 		return;
-
+	m_clrprotoflags(m);
 	SBLASTRECORDCHK(sb);
 	n = sb->sb_mb;
 	if (n) {
@@ -732,6 +732,7 @@ sbappendrecord_locked(struct sockbuf *sb, struct mbuf *m0)
 
 	if (m0 == 0)
 		return;
+	m_clrprotoflags(m0);
 	/*
 	 * Put the first mbuf on the queue.  Note this permits zero length
 	 * records.
@@ -777,6 +778,8 @@ sbappendaddr_locked_internal(struct sockbuf *sb, const struct sockaddr *asa,
 		return (0);
 	m->m_len = asa->sa_len;
 	bcopy(asa, mtod(m, caddr_t), asa->sa_len);
+	if (m0)
+		m_clrprotoflags(m0);
 	if (ctrl_last)
 		ctrl_last->m_next = m0;	/* concatenate data to control */
 	else
@@ -872,6 +875,7 @@ sbappendcontrol_locked(struct sockbuf *sb, struct mbuf *m0,
 
 	if (space > sbspace(sb))
 		return (0);
+	m_clrprotoflags(m0);
 	n->m_next = m0;			/* concatenate data to control */
 
 	SBLASTRECORDCHK(sb);