:> Well, that was an easy fix. I've committed a fix, please continue
:> to try to crash the box with packets!
:>
:> The patch is enclosed
:
:The patch didn't fix the problem. However with a bit of digging, it seems that
:this particular crash can be stopped with:
Ach. You are right. I have to move the NULL check down a level. I'll
commit another patch. In fact, there is another second of code in the
same file which does it eactly the way you indicate below.
:However it seems that if mcl == NULL && how != MB_WAIT then there is
:no point in trying to allocate data, so the routine should fail there. Also
:the
:case where mcl == NULL, how != MB_WAIT tries to use the null mcl if
:data is successfully allocated. I think that something like the
:following seems needed:
:
:if (mcl == NULL){
: if (how != MB_WAIT)
: break;
: mbstat.m_wait++;
: mcl = malloc(sizeof(*mcl),M_MBUFCL, M_WAITOK|M_NULLOK|M_ZERO);
: if (mcl == NULL){
: break;
: }
:}
:
:hopefully this is clear.
:
:EM
Ok, here is another patch.
-Matt
Matthew Dillon
<dillon at xxxxxxxxxxxxx>
Index: uipc_mbuf.c
===================================================================
RCS file: /cvs/src/sys/kern/uipc_mbuf.c,v
retrieving revision 1.30
diff -u -r1.30 uipc_mbuf.c
--- uipc_mbuf.c 4 Feb 2005 01:14:27 -0000 1.30
+++ uipc_mbuf.c 4 Feb 2005 19:11:06 -0000
@@ -82,7 +82,7 @@
*
* @(#)uipc_mbuf.c 8.2 (Berkeley) 1/4/94
* $FreeBSD: src/sys/kern/uipc_mbuf.c,v 1.51.2.24 2003/04/15 06:59:29 silby Exp $
- * $DragonFly: src/sys/kern/uipc_mbuf.c,v 1.30 2005/02/04 01:14:27 dillon Exp $
+ * $DragonFly$
*/
#include "opt_param.h"
@@ -424,10 +424,12 @@
* Meta structure
*/
mcl = malloc(sizeof(*mcl), M_MBUFCL, M_NOWAIT|M_NULLOK|M_ZERO);
- if (mcl == NULL && how == MB_WAIT) {
- mbstat.m_wait++;
- mcl = malloc(sizeof(*mcl),
- M_MBUFCL, M_WAITOK|M_NULLOK|M_ZERO);
+ if (mcl == NULL) {
+ if (how == MB_WAIT) {
+ mbstat.m_wait++;
+ mcl = malloc(sizeof(*mcl),
+ M_MBUFCL, M_WAITOK|M_NULLOK|M_ZERO);
+ }
if (mcl == NULL)
break;
}