git: 25165e4499e1 - main - mbuf: Make m_unshare() fail on KTLS mbufs

The branch main has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=25165e4499e17f4f75fcf7fe7691fc7f865d4015

commit 25165e4499e17f4f75fcf7fe7691fc7f865d4015
Author:     KUROSAWA Takahiro <takahiro.kurosawa@gmail.com>
AuthorDate: 2026-07-30 12:30:03 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-07-30 12:30:25 +0000

    mbuf: Make m_unshare() fail on KTLS mbufs
    
    Commit f2202ab5abda did not account for  KTLS mbufs.
    
    m_unshare() tries to linearize the original mbuf chain and creates a
    writable copy of it, converting unmapped mbufs.  Both of them are
    unsafe for KTLS mbufs.
    
    It is better to return NULL if the mbuf chain contains a KTLS mbuf.
    
    Reported by:    jhb
    Reviewed by:    jhb
    Differential Revision:  https://reviews.freebsd.org/D58466
---
 sys/kern/uipc_mbuf.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index ffdd115e3e0a..3f7841721a86 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -2147,6 +2147,15 @@ m_unshare(struct mbuf *m0, int how)
 
 	mprev = NULL;
 	for (m = m0; m != NULL; m = mprev->m_next) {
+		/*
+		 * m_unshare() can not process KTLS mbufs because they must
+		 * neither be linearized nor converted to mapped.
+		 */
+		if (mbuf_has_tls_session(m)) {
+			m_freem(m0);
+			return (NULL);
+		}
+
 		/*
 		 * Regular mbufs are ignored unless there's a cluster
 		 * in front of it that we can use to coalesce.  We do