svn commit: r350829 - stable/11/sys/kern

[Jonathan T. Looney]

Author: jtl
Date: Sat Aug 10 00:02:45 2019
New Revision: 350829
URL: https://svnweb.freebsd.org/changeset/base/350829

Log:
  MFC r350815:
    In m_pulldown(), before trying to prepend bytes to the subsequent mbuf,
    ensure that the subsequent mbuf contains the remainder of the bytes
    the caller sought. If this is not the case, fall through to the code
    which gathers the bytes in a new mbuf.
  
    This fixes a bug where m_pulldown() could fail to gather all the desired
    bytes into consecutive memory.
  
  PR:		238787
  Approved by:	so (emaste)

Modified:
  stable/11/sys/kern/uipc_mbuf2.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/kern/uipc_mbuf2.c
==============================================================================
--- stable/11/sys/kern/uipc_mbuf2.c	Sat Aug 10 00:01:25 2019	(r350828)
+++ stable/11/sys/kern/uipc_mbuf2.c	Sat Aug 10 00:02:45 2019	(r350829)
@@ -214,7 +214,7 @@ m_pulldown(struct mbuf *m, int off, int len, int *offp
 		goto ok;
 	}
 	if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
-	 && writable) {
+	 && writable && n->m_next->m_len >= tlen) {
 		n->m_next->m_data -= hlen;
 		n->m_next->m_len += hlen;
 		bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);