diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2018-03-18 21:25:15 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2018-03-18 21:25:15 +0000 |
| commit | 286db2aee754ca2ec79603fa10f11e38b39de955 (patch) | |
| tree | 474cef13ae19bcc46a4b7b555b78b834b2c99320 /sys | |
| parent | 380ed72672bf7cfcdab67e8a9f8fe4a42b57d075 (diff) | |
NULL deref on armv7 performing NFS, within 10 seconds.
Previous commit has no OK's or discussion about testing.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/uipc_mbuf.c | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index 82e9367fdb8..5bb5c624978 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_mbuf.c,v 1.255 2018/03/13 01:34:06 dlg Exp $ */ +/* $OpenBSD: uipc_mbuf.c,v 1.256 2018/03/18 21:25:14 deraadt Exp $ */ /* $NetBSD: uipc_mbuf.c,v 1.15.4.1 1996/06/13 17:11:44 cgd Exp $ */ /* @@ -888,11 +888,7 @@ m_pullup(struct mbuf *n, int len) if (len <= n->m_len) return (n); - m = n; - while (m->m_len == 0) - m = m->m_next; - adj = (unsigned long)m->m_data & ALIGNBYTES; - + adj = (unsigned long)n->m_data & ALIGNBYTES; head = (caddr_t)ALIGN(mtod(n, caddr_t) - M_LEADINGSPACE(n)) + adj; tail = mtod(n, caddr_t) + n->m_len + M_TRAILINGSPACE(n); |