From owner-svn-src-head@FreeBSD.ORG Mon Feb 23 13:41:36 2015 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BF4EF535; Mon, 23 Feb 2015 13:41:36 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AA72F3C5; Mon, 23 Feb 2015 13:41:36 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t1NDfaf2029089; Mon, 23 Feb 2015 13:41:36 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t1NDfaPh029088; Mon, 23 Feb 2015 13:41:36 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201502231341.t1NDfaPh029088@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Mon, 23 Feb 2015 13:41:36 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r279206 - head/sys/kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Feb 2015 13:41:36 -0000 Author: ae Date: Mon Feb 23 13:41:35 2015 New Revision: 279206 URL: https://svnweb.freebsd.org/changeset/base/279206 Log: In some cases soreceive_dgram() can return no data, but has control message. This can happen when application is sending packets too big for the path MTU and recvmsg() will return zero (indicating no data) but there will be a cmsghdr with cmsg_type set to IPV6_PATHMTU. Remove KASSERT() which does NULL pointer dereference in such case. Also call m_freem() only when m isn't NULL. PR: 197882 MFC after: 1 week Sponsored by: Yandex LLC Modified: head/sys/kern/uipc_socket.c Modified: head/sys/kern/uipc_socket.c ============================================================================== --- head/sys/kern/uipc_socket.c Mon Feb 23 12:54:46 2015 (r279205) +++ head/sys/kern/uipc_socket.c Mon Feb 23 13:41:35 2015 (r279206) @@ -2255,7 +2255,8 @@ soreceive_dgram(struct socket *so, struc * Process one or more MT_CONTROL mbufs present before any data mbufs * in the first mbuf chain on the socket buffer. We call into the * protocol to perform externalization (or freeing if controlp == - * NULL). + * NULL). In some cases there can be only MT_CONTROL mbufs without + * MT_DATA mbufs. */ if (m->m_type == MT_CONTROL) { struct mbuf *cm = NULL, *cmn; @@ -2285,8 +2286,6 @@ soreceive_dgram(struct socket *so, struc cm = cmn; } } - KASSERT(m->m_type == MT_DATA, ("soreceive_dgram: !data")); - while (m != NULL && uio->uio_resid > 0) { len = uio->uio_resid; if (len > m->m_len) @@ -2303,9 +2302,10 @@ soreceive_dgram(struct socket *so, struc m->m_len -= len; } } - if (m != NULL) + if (m != NULL) { flags |= MSG_TRUNC; - m_freem(m); + m_freem(m); + } if (flagsp != NULL) *flagsp |= flags; return (0);