In spx_output(), use M_DONTWAIT instead of M_TRYWAIT, as we hold the

ipxpcb mutex.  Contrary to the comment, even in 4.x this was unsafe,
as parallel use of the socket by another process would result in pcb
corruption if the mbuf allocation slept.

MFC after:	1 month

1 files changed, 6 insertions, 5 deletions

diff --git a/sys/netipx/spx_usrreq.c b/sys/netipx/spx_usrreq.c
index c13dff5..7db43b3 100644
--- a/sys/netipx/spx_usrreq.c
+++ b/sys/netipx/spx_usrreq.c
@@ -759,11 +759,12 @@ spx_output(struct spxpcb *cb, struct mbuf *m0)
 
 				cb->s_cc &= ~SPX_EM;
 				while (len > mtu) {
-					/*
-					 * Here we are only being called from
-					 * usrreq(), so it is OK to block.
-					 */
-					m = m_copym(m0, 0, mtu, M_TRYWAIT);
+					m = m_copym(m0, 0, mtu, M_DONTWAIT);
+					if (m == NULL) {
+					    cb->s_cc |= oldEM;
+					    m_freem(m0);
+					    return (ENOBUFS);
+					}
 					if (cb->s_flags & SF_NEWCALL) {
 					    struct mbuf *mm = m;
 					    spx_newchecks[7]++;