[src/netbsd-1-5]: src/sys/kern pullup 1.48 -> 1.50 (approved by releng-1-5)

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5a7e44d4d63f
branches:  netbsd-1-5
changeset: 489138:5a7e44d4d63f
user:      itojun <itojun%NetBSD.org@localhost>
date:      Sat Aug 19 07:55:31 2000 +0000

description:
pullup 1.48 -> 1.50 (approved by releng-1-5)
repair m_dup().  specifically, now it is safe against non-MCLBYTES external
mbuf.  noone seem to be using this function at this moment.

diffstat:

 sys/kern/uipc_mbuf.c |  23 +++++++++++++++++++----
 1 files changed, 19 insertions(+), 4 deletions(-)

diffs (45 lines):

diff -r 87390982797c -r 5a7e44d4d63f sys/kern/uipc_mbuf.c
--- a/sys/kern/uipc_mbuf.c      Fri Aug 18 10:47:39 2000 +0000
+++ b/sys/kern/uipc_mbuf.c      Sat Aug 19 07:55:31 2000 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_mbuf.c,v 1.45 2000/03/01 12:49:28 itojun Exp $    */
+/*     $NetBSD: uipc_mbuf.c,v 1.45.4.1 2000/08/19 07:55:31 itojun Exp $        */
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -469,8 +469,16 @@
                                n->m_ext = m->m_ext;
                                MCLADDREFERENCE(m, n);
                        } else {
+                               /*
+                                * we are unsure about the way m was allocated.
+                                * copy into multiple MCLBYTES cluster mbufs.
+                                */
                                MCLGET(n, wait);
-                               memcpy(mtod(n, caddr_t), mtod(m, caddr_t)+off,
+                               n->m_len = 0;
+                               n->m_len = M_TRAILINGSPACE(n);
+                               n->m_len = min(n->m_len, len);
+                               n->m_len = min(n->m_len, m->m_len - off);
+                               memcpy(mtod(n, caddr_t), mtod(m, caddr_t) + off,
                                    (unsigned)n->m_len);
                        }
                } else
@@ -478,8 +486,15 @@
                            (unsigned)n->m_len);
                if (len != M_COPYALL)
                        len -= n->m_len;
-               off = 0;
-               m = m->m_next;
+               off += n->m_len;
+#ifdef DIAGNOSTIC
+               if (off > m->m_len)
+                       panic("m_copym0 overrun");
+#endif
+               if (off == m->m_len) {
+                       m = m->m_next;
+                       off = 0;
+               }
                np = &n->m_next;
        }
        if (top == 0)