From: Matthew Dillon <dillon@apollo.backplane.com>
Date: Sun, 12 Sep 2010 04:35:14 +0000 (-0700)
Subject: network - Assert that the packet's data has not overrrun the buffer in m_free()
X-Git-Tag: v2.9.0~222
X-Git-Url: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/f3f0fc49b1e60b1f9ed89926d40bfc694cb73007

network - Assert that the packet's data has not overrrun the buffer in m_free()

* Add an assertion to try to catch subsystems which blow up a mbuf's
  data buffer.
---

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index 75120a25e8..b0bb3f1300 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -922,6 +922,7 @@ m_free(struct mbuf *m)
 	struct globaldata *gd = mycpu;
 
 	KASSERT(m->m_type != MT_FREE, ("freeing free mbuf %p", m));
+	KASSERT(M_TRAILINGSPACE(m) >= 0, ("overflowed mbuf %p", m));
 	atomic_subtract_long_nonlocked(&mbtypes[gd->gd_cpuid][m->m_type], 1);
 
 	n = m->m_next;