[src/trunk]: src/sys/nfs When partitioning a mbuf chain with m_split() the la...

[hannken <hannken%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1ffcb06f681c
branches:  trunk
changeset: 372684:1ffcb06f681c
user:      hannken <hannken%NetBSD.org@localhost>
date:      Tue Dec 20 09:40:09 2022 +0000

description:
When partitioning a mbuf chain with m_split() the last mbuf of the returned
tail chain is not necessarily the same as the last mbuf of the initial chain.

Always set "slp->ns_rawend" to the last mbuf of the tail chain to prevent
mbuf leaks and corruption.

diffstat:

 sys/nfs/nfs_srvsocket.c |  9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r 67ea79879497 -r 1ffcb06f681c sys/nfs/nfs_srvsocket.c
--- a/sys/nfs/nfs_srvsocket.c   Tue Dec 20 04:57:01 2022 +0000
+++ b/sys/nfs/nfs_srvsocket.c   Tue Dec 20 09:40:09 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: nfs_srvsocket.c,v 1.4 2009/09/03 20:59:12 tls Exp $    */
+/*     $NetBSD: nfs_srvsocket.c,v 1.5 2022/12/20 09:40:09 hannken Exp $        */
 
 /*
  * Copyright (c) 1989, 1991, 1993, 1995
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nfs_srvsocket.c,v 1.4 2009/09/03 20:59:12 tls Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nfs_srvsocket.c,v 1.5 2022/12/20 09:40:09 hannken Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -323,8 +323,9 @@
                        }
                        m_claimm(recm, &nfs_mowner);
                        slp->ns_raw = m;
-                       if (m->m_next == NULL)
-                               slp->ns_rawend = m;
+                       while (m->m_next)
+                               m = m->m_next;
+                       slp->ns_rawend = m;
                        slp->ns_cc -= slp->ns_reclen;
                        slp->ns_reclen = 0;
                } else {