svn commit: r350815 - head/sys/kern

[Jonathan T. Looney]

Author: jtl
Date: Fri Aug  9 05:18:59 2019
New Revision: 350815
URL: https://svnweb.freebsd.org/changeset/base/350815

Log:
  In m_pulldown(), before trying to prepend bytes to the subsequent mbuf,
  ensure that the subsequent mbuf contains the remainder of the bytes
  the caller sought. If this is not the case, fall through to the code
  which gathers the bytes in a new mbuf.
  
  This fixes a bug where m_pulldown() could fail to gather all the desired
  bytes into consecutive memory.
  
  PR:		238787
  Reported by:	A reddit user
  Discussed with:	emaste
  Obtained from:	NetBSD
  MFC after:	3 days

Modified:
  head/sys/kern/uipc_mbuf2.c

Modified: head/sys/kern/uipc_mbuf2.c
==============================================================================
--- head/sys/kern/uipc_mbuf2.c	Fri Aug  9 02:20:26 2019	(r350814)
+++ head/sys/kern/uipc_mbuf2.c	Fri Aug  9 05:18:59 2019	(r350815)
@@ -216,7 +216,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp
 		goto ok;
 	}
 	if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
-	 && writable) {
+	 && writable && n->m_next->m_len >= tlen) {
 		n->m_next->m_data -= hlen;
 		n->m_next->m_len += hlen;
 		bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);