From 4f71d026f8087303d3275d6eb52644273d89fa85 Mon Sep 17 00:00:00 2001 From: csjp Date: Sat, 5 Jul 2008 20:11:28 +0000 Subject: Make sure we are clearing the ZBUF_FLAG_IMMUTABLE any time a free buffer is reclaimed by the kernel. This fixes a bug resulted in the kernel over writing packet data while user-space was still processing it when zerocopy is enabled. (Or a panic if invariants was enabled). Discussed with: rwatson --- sys/net/bpf_zerocopy.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'sys/net/bpf_zerocopy.c') diff --git a/sys/net/bpf_zerocopy.c b/sys/net/bpf_zerocopy.c index 9ca2ba7..de4d49a 100644 --- a/sys/net/bpf_zerocopy.c +++ b/sys/net/bpf_zerocopy.c @@ -410,6 +410,24 @@ bpf_zerocopy_bufheld(struct bpf_d *d) } /* + * Notification from the BPF framework that the free buffer has been been + * re-assigned. This happens when the user ackknowledges the buffer. + */ +void +bpf_zerocopy_buf_reclaimed(struct bpf_d *d) +{ + struct zbuf *zb; + + KASSERT(d->bd_bufmode == BPF_BUFMODE_ZBUF, + ("bpf_zerocopy_reclaim_buf: not in zbuf mode")); + + KASSERT(d->bd_fbuf != NULL, + ("bpf_zerocopy_buf_reclaimed: NULL free buff")); + zb = (struct zbuf *)d->bd_fbuf; + zb->zb_flags &= ~ZBUF_FLAG_IMMUTABLE; +} + +/* * Query from the BPF framework regarding whether the buffer currently in the * held position can be moved to the free position, which can be indicated by * the user process making their generation number equal to the kernel -- cgit v1.1