Date: Fri, 31 May 2002 11:56:35 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Archie Cobbs <archie@dellroad.org> Cc: freebsd-net@FreeBSD.ORG Subject: Re: m_split() considered harmful Message-ID: <20020531115635.B45530@iguana.icir.org> In-Reply-To: <200205311829.g4VITKM01684@arch20m.dellroad.org>; from archie@dellroad.org on Fri, May 31, 2002 at 11:29:20AM -0700 References: <200205311829.g4VITKM01684@arch20m.dellroad.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, May 31, 2002 at 11:29:20AM -0700, Archie Cobbs wrote:
...
if you add the additional Note, then it might be worthwhile that the
writability of the returned buffer should be checked in the
standard way (whatever macro it is, i forget the name).
cheers
luigi
>
> --- kern/uipc_mbuf.c.orig Fri May 31 11:17:52 2002
> +++ kern/uipc_mbuf.c Fri May 31 11:27:42 2002
> @@ -1194,6 +1194,10 @@
> * Partition an mbuf chain in two pieces, returning the tail --
> * all but the first len0 bytes. In case of failure, it returns NULL and
> * attempts to restore the chain to its original state.
> + *
> + * Note that the returned mbuf must be treated as read-only, because
> + * it will end up sharing an mbuf cluster with the original mbuf if the
> + * "breaking point" happens to lie within a cluster mbuf.
> */
> struct mbuf *
> m_split(m0, len0, wait)
> @@ -1247,7 +1251,6 @@
> else
> (*(m->m_ext.ext_ref))(m->m_ext.ext_buf,
> m->m_ext.ext_size);
> - m->m_ext.ext_size = 0; /* For Accounting XXXXXX danger */
> n->m_data = m->m_data + len;
> } else {
> bcopy(mtod(m, caddr_t) + len, mtod(n, caddr_t), remain);
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-net" in the body of the message
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020531115635.B45530>