During fragment reassembly, mbuf chains with packet headers were

created.  Add a new function m_removehdr() do convert packet header
mbufs within the chain to regular mbufs.  Assert that the mbuf at
the beginning of the chain has a packet header.
found by Maxime Villard in NetBSD; from markus@; OK claudio@

1 files changed, 23 insertions, 10 deletions

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index 5bb5c624978..2dda4b56292 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_mbuf.c,v 1.256 2018/03/18 21:25:14 deraadt Exp $	*/
+/*	$OpenBSD: uipc_mbuf.c,v 1.257 2018/09/10 12:47:02 bluhm Exp $	*/
 /*	$NetBSD: uipc_mbuf.c,v 1.15.4.1 1996/06/13 17:11:44 cgd Exp $	*/
 
 /*
@@ -291,15 +291,9 @@ m_inithdr(struct mbuf *m)
 	return (m);
 }
 
-void
-m_resethdr(struct mbuf *m)
+static inline void
+m_clearhdr(struct mbuf *m)
 {
-	int len = m->m_pkthdr.len;
-	u_int8_t loopcnt = m->m_pkthdr.ph_loopcnt;
-
-	KASSERT(m->m_flags & M_PKTHDR);
-	m->m_flags &= (M_EXT|M_PKTHDR|M_EOR|M_EXTWR|M_ZEROIZE);
-
 	/* delete all mbuf tags to reset the state */
 	m_tag_delete_chain(m);
 
@@ -307,8 +301,27 @@ m_resethdr(struct mbuf *m)
 	pf_mbuf_unlink_state_key(m);
 #endif	/* NPF > 0 */
 
-	/* like m_inithdr(), but keep any associated data and mbufs */
 	memset(&m->m_pkthdr, 0, sizeof(m->m_pkthdr));
+}
+
+void
+m_removehdr(struct mbuf *m)
+{
+	KASSERT(m->m_flags & M_PKTHDR);
+	m_clearhdr(m);
+	m->m_flags &= ~M_PKTHDR;
+}
+
+void
+m_resethdr(struct mbuf *m)
+{
+	int len = m->m_pkthdr.len;
+	u_int8_t loopcnt = m->m_pkthdr.ph_loopcnt;
+
+	KASSERT(m->m_flags & M_PKTHDR);
+	m->m_flags &= (M_EXT|M_PKTHDR|M_EOR|M_EXTWR|M_ZEROIZE);
+	m_clearhdr(m);
+	/* like m_inithdr(), but keep any associated data and mbufs */
 	m->m_pkthdr.pf.prio = IFQ_DEFPRIO;
 	m->m_pkthdr.len = len;
 	m->m_pkthdr.ph_loopcnt = loopcnt;