From nobody  Mon Jun 29 17:37:56 1998
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id RAA14233;
          Mon, 29 Jun 1998 17:37:56 -0700 (PDT)
          (envelope-from nobody)
Message-Id: <199806300037.RAA14233@hub.freebsd.org>
Date: Mon, 29 Jun 1998 17:37:56 -0700 (PDT)
From: castor@geocast.com
To: freebsd-gnats-submit@freebsd.org
Subject: m_copypacket will fail with external mbuf clusters
X-Send-Pr-Version: www-1.0

>Number:         7122
>Category:       kern
>Synopsis:       m_copypacket will fail with external mbuf clusters
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    dg
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 29 17:40:02 PDT 1998
>Closed-Date:    Fri Jul 3 01:36:54 PDT 1998
>Last-Modified:  Fri Jul  3 01:37:25 PDT 1998
>Originator:     Castor Fu
>Release:        2.2.6-STABLE
>Organization:
Geocast Network Systems
>Environment:
FreeBSD host1.geocast.net 2.2.6-STABLE FreeBSD 2.2.6-S i386 i386
>Description:
sys/mbuf.h provides a mechanism which is seldom (if ever) used
for freeing externally managed mbuf clusters.  The 4.4 BSD book mentions that
there were problems with the original implementation because there
was no mechanism for keeping track of external references generated
for the mbuf cluster.

FreeBSD attempts to fix this by providing an ext_ref() mechanism,
and the code in m_copym() looks reasonable, though there are no
routines in the FreeBSD source tree which use this facility.  

However, these changes where not propagated through to m_copypacket().  

m_copypacket() also appears to be unused.
>How-To-Repeat:
Write something which uses an externally managed memory pool.
Wriet something which uses m_copypacket().
Spend time looking for memory leaks.

>Fix:
(clf1025) diff  /usr/src/sys/kern/uipc_mbuf.c /tmp/uipc_mbuf.c  
426,430c426
<               if(!m->m_ext.ext_ref)
<                       mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
<               else
<                       (*(m->m_ext.ext_ref))(m->m_ext.ext_buf,
<                                               m->m_ext.ext_size);
---
>               mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
449,453c445
<                       if(!m->m_ext.ext_ref)
<                               mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
<                       else
<                               (*(m->m_ext.ext_ref))(m->m_ext.ext_buf,
<                                                       m->m_ext.ext_size);
---
>                       mclrefcnt[mtocl(m->m_ext.ext_buf)]++;

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->dg 
Responsible-Changed-By: jkh 
Responsible-Changed-When: Tue Jun 30 00:22:06 PDT 1998 
Responsible-Changed-Why:  
This looks like something for David Greenman 

From: David Greenman <dg@root.com>
To: castor@geocast.com
Cc: freebsd-gnats-submit@FreeBSD.ORG
Subject: Re: kern/7122: m_copypacket will fail with external mbuf clusters 
Date: Tue, 30 Jun 1998 08:18:31 -0700

    It's difficult to tell what your patch does. Can you please resend the
 patch in the form of a context diff (diff -c), please?
 
 -DG
 
 David Greenman
 Co-founder/Principal Architect, The FreeBSD Project

From: Castor Fu <castor@geocast.net>
To: David Greenman <dg@root.com>
Cc: castor@geocast.com, freebsd-gnats-submit@FreeBSD.ORG
Subject: Re: kern/7122: m_copypacket will fail with external mbuf clusters 
Date: Tue, 30 Jun 1998 08:37:58 -0700 (PDT)

 On Tue, 30 Jun 1998, David Greenman wrote:
 
 > Subject: Re: kern/7122: m_copypacket will fail with external mbuf clusters 
 > 
 >    It's difficult to tell what your patch does. Can you please resend the
 > patch in the form of a context diff (diff -c), please?
 
 Sorry.  I should add that I haven't really tested this, but found it
 while trying to determine if the m->m_ext.ext_ref stuff would work.
 I just copied the behavior from m_copym().
 
 	-castor
 
 (clf1028) diff -c uipc_mbuf.c /tmp/uipc_mbuf.c 
 *** uipc_mbuf.c Mon Jun 29 17:16:45 1998
 --- /tmp/uipc_mbuf.c    Mon Jun 29 17:31:47 1998
 ***************
 *** 423,433 ****
         n->m_len = m->m_len;
         if (m->m_flags & M_EXT) {
                 n->m_data = m->m_data;
 !               if(!m->m_ext.ext_ref)
 !                       mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
 !               else
 !                       (*(m->m_ext.ext_ref))(m->m_ext.ext_buf,
 !                                               m->m_ext.ext_size);
                 n->m_ext = m->m_ext;
                 n->m_flags |= M_EXT;
         } else {
 --- 423,429 ----
         n->m_len = m->m_len;
         if (m->m_flags & M_EXT) {
                 n->m_data = m->m_data;
 !               mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
                 n->m_ext = m->m_ext;
                 n->m_flags |= M_EXT;
         } else {
 ***************
 *** 446,456 ****
                 n->m_len = m->m_len;
                 if (m->m_flags & M_EXT) {
                         n->m_data = m->m_data;
 !                       if(!m->m_ext.ext_ref)
 !                               mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
 !                       else
 !                               (*(m->m_ext.ext_ref))(m->m_ext.ext_buf,
 !                                                       m->m_ext.ext_size);
                         n->m_ext = m->m_ext;
                         n->m_flags |= M_EXT;
                 } else {
 --- 442,448 ----
                 n->m_len = m->m_len;
                 if (m->m_flags & M_EXT) {
                         n->m_data = m->m_data;
 !                       mclrefcnt[mtocl(m->m_ext.ext_buf)]++;
                         n->m_ext = m->m_ext;
                         n->m_flags |= M_EXT;
                 } else {
 
 
State-Changed-From-To: open->closed 
State-Changed-By: phk 
State-Changed-When: Fri Jul 3 01:36:54 PDT 1998 
State-Changed-Why:  
committed, thanks. 

please never cut&paste patches, tabs get lost that way. 
>Unformatted:
