aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2010-07-13 02:45:17 +0000
committerColin Percival <cperciva@FreeBSD.org>2010-07-13 02:45:17 +0000
commite811d1f0f629245d33b338438789e857d01a47b1 (patch)
treee0a41ed2c0f49cf9f47e7640e2782555a11e880b
parenta6b5951a1159278502d0b699efcdf9276a4334db (diff)
downloadsrc-e811d1f0f629245d33b338438789e857d01a47b1.tar.gz
src-e811d1f0f629245d33b338438789e857d01a47b1.zip
Correctly copy the M_RDONLY flag when duplicating a reference
to an mbuf external buffer. Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-10:07.mbuf
Notes
Notes: svn path=/releng/8.0/; revision=209964
-rw-r--r--UPDATING4
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/kern/uipc_mbuf.c1
3 files changed, 6 insertions, 1 deletions
diff --git a/UPDATING b/UPDATING
index b326a7112120..262aab2cba6c 100644
--- a/UPDATING
+++ b/UPDATING
@@ -15,6 +15,10 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 8.x IS SLOW ON IA64 OR SUN4V:
debugging tools present in HEAD were left in place because
sun4v support still needs work to become production ready.
+20100713: p4 FreeBSD-SA-10:07.mbuf
+ Correctly copy the M_RDONLY flag when duplicating a reference
+ to an mbuf external buffer.
+
20100526: p3 FreeBSD-SA-10:04.jail, FreeBSD-SA-10:05.opie,
FreeBSD-SA-10:06.nfsclient
Change the current working directory to be inside the jail created by
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index e71b051674f6..8bdb7593fe1a 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="8.0"
-BRANCH="RELEASE-p3"
+BRANCH="RELEASE-p4"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index bc0e88d0a477..6e43348e08a0 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -302,6 +302,7 @@ mb_dupcl(struct mbuf *n, struct mbuf *m)
n->m_ext.ref_cnt = m->m_ext.ref_cnt;
n->m_ext.ext_type = m->m_ext.ext_type;
n->m_flags |= M_EXT;
+ n->m_flags |= m->m_flags & M_RDONLY;
}
/*