diff options
author | jhb <jhb@FreeBSD.org> | 2016-05-26 18:35:37 +0000 |
---|---|---|
committer | jhb <jhb@FreeBSD.org> | 2016-05-26 18:35:37 +0000 |
commit | 7a26d36370351fa81dba61972dc9e78b3090d5db (patch) | |
tree | 02830d3adaf4488bdd45c3ed8c2693803751218c /lib/libc/stdio/fopencookie.3 | |
parent | 7bab6f903636c3b21cdca0d91c8eef7833fe26fb (diff) | |
download | FreeBSD-src-7a26d36370351fa81dba61972dc9e78b3090d5db.zip FreeBSD-src-7a26d36370351fa81dba61972dc9e78b3090d5db.tar.gz |
Don't reuse the source mbuf in tcp_respond() if it is not writable.
Not all mbufs passed up from device drivers are M_WRITABLE(). In
particular, the Chelsio T4/T5 driver uses a feature called "buffer packing"
to receive multiple frames in a single receive buffer. The mbufs for
these frames all share the same external storage so are treated as
read-only by the rest of the stack when multiple frames are in flight.
Previously tcp_respond() would blindly overwrite read-only mbufs when
INVARIANTS was disabled or panic with an assertion failure if INVARIANTS
was enabled. Note that the new case is a bit of a mix of the two other
cases in tcp_respond(). The TCP and IP headers must be copied explicitly
into the new mbuf instead of being inherited (similar to the m == NULL
case), but the addresses and ports must be swapped in the reply (similar
to the m != NULL case).
Reviewed by: glebius
Diffstat (limited to 'lib/libc/stdio/fopencookie.3')
0 files changed, 0 insertions, 0 deletions