svn commit: r305548 - head/sys/dev/cxgbe
John Baldwin
jhb at FreeBSD.org
Wed Sep 7 18:08:44 UTC 2016
Author: jhb
Date: Wed Sep 7 18:08:43 2016
New Revision: 305548
URL: https://svnweb.freebsd.org/changeset/base/305548
Log:
Don't break out of the m_advance() loop if len drops to zero.
If a packet contains the Ethernet header (14 bytes) in the first mbuf
and the payload (IP + UDP + data) in the second mbuf, then the attempt
to fetch the l3hdr will return a NULL pointer. The first loop iteration
will drop len to zero and exit the loop without setting 'p'. However,
the desired data is at the start of the second mbuf, so the correct
behavior is to loop around and let the conditional set 'p' to m_data of
the next mbuf (and leave offset as 0).
Reviewed by: np
Sponsored by: Chelsio Communications
Modified:
head/sys/dev/cxgbe/t4_sge.c
Modified: head/sys/dev/cxgbe/t4_sge.c
==============================================================================
--- head/sys/dev/cxgbe/t4_sge.c Wed Sep 7 18:06:34 2016 (r305547)
+++ head/sys/dev/cxgbe/t4_sge.c Wed Sep 7 18:08:43 2016 (r305548)
@@ -2082,7 +2082,7 @@ m_advance(struct mbuf **pm, int *poffset
MPASS(len > 0);
- while (len) {
+ for (;;) {
if (offset + len < m->m_len) {
offset += len;
p = mtod(m, uintptr_t) + offset;
More information about the svn-src-all
mailing list