git: 4814de3243e0 - main - unix/stream: fix bugs in sendfile(2) operation

The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=4814de3243e091c48453b4fd6c818437ac1985f7

commit 4814de3243e091c48453b4fd6c818437ac1985f7
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2025-05-22 21:47:41 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2025-05-22 21:49:37 +0000

    unix/stream: fix bugs in sendfile(2) operation
    
    - In send(2) don't update sb_acc if appending behind uxst_fnrdy
    - In recv(2) don't read beyond uxst_fnrdy
    - In the debug code allow ready, but blocked mbufs beyond uxst_fnrdy
---
 sys/kern/uipc_usrreq.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index 164030eec7ab..3181868175a8 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -1012,7 +1012,7 @@ uipc_stream_sbcheck(struct sockbuf *sb)
 		if (d == sb->uxst_fnrdy)
 			notready = true;
 		if (notready)
-			MPASS(d->m_flags & M_NOTREADY);
+			MPASS(d->m_flags & (M_NOTREADY|M_BLOCKED));
 		if (d->m_type == MT_CONTROL)
 			dctl += d->m_len;
 		else if (d->m_type == MT_DATA) {
@@ -1246,7 +1246,8 @@ restart:
 			cmc.mc_len = 0;
 		}
 		sent += mc.mc_len;
-		sb->sb_acc += mc.mc_len;
+		if (sb->uxst_fnrdy == NULL)
+			sb->sb_acc += mc.mc_len;
 		sb->sb_ccc += mc.mc_len;
 		sb->sb_mbcnt += mc.mc_mlen;
 		STAILQ_CONCAT(&sb->uxst_mbq, &mc.mc_q);
@@ -1397,11 +1398,13 @@ restart:
 	 * last == NULL - socket to be flushed
 	 * last != NULL
 	 *   lastlen > last->m_len - uio to be filled, last to be adjusted
-	 *   lastlen == 0          - MT_CONTROL or M_EOR encountered
+	 *   lastlen == 0          - MT_CONTROL, M_EOR or M_NOTREADY encountered
 	 */
 	space = uio->uio_resid;
 	datalen = 0;
-	for (m = first, last = NULL; m != NULL; m = STAILQ_NEXT(m, m_stailq)) {
+	for (m = first, last = sb->uxst_fnrdy, lastlen = 0;
+	     m != sb->uxst_fnrdy;
+	     m = STAILQ_NEXT(m, m_stailq)) {
 		if (m->m_type != MT_DATA) {
 			last = m;
 			lastlen = 0;