m_copyback issue

[Sean Boudreau <seanb%qnx.com@localhost>]

Hi:


There's a case in m_copyback() where a new segment
(n) can be inserted where n->m_next = n.  This can
arise when the m_split() is skipped and code local
to m_copyback() which emulates m_split() is called.
The attached diff removes this emulated code and
always uses m_split() when applicable.  Any concerns
before I commit?

Thanks,

-seanb

Index: kern/uipc_mbuf.c
===================================================================
RCS file: /cvsroot/src/sys/kern/uipc_mbuf.c,v
retrieving revision 1.136
diff -u -r1.136 uipc_mbuf.c
--- kern/uipc_mbuf.c    11 May 2010 20:21:56 -0000      1.136
+++ kern/uipc_mbuf.c    21 Oct 2010 16:11:18 -0000
@@ -1346,7 +1346,7 @@
                         * if we're going to write into the middle of
                         * a mbuf, split it first.
                         */
-                       if (off > 0 && len < mlen) {
+                       if (off > 0) {
                                n = m_split0(m, off, how, 0);
                                if (n == NULL)
                                        goto enobufs;
@@ -1390,19 +1390,6 @@
                        else
                                datap = NULL;
                        eatlen = n->m_len;
-                       KDASSERT(off == 0 || eatlen >= mlen);
-                       if (off > 0) {
-                               KDASSERT(len >= mlen);
-                               m->m_len = off;
-                               m->m_next = n;
-                               if (datap) {
-                                       m_copydata(m, off, mlen, datap);
-                                       datap += mlen;
-                               }
-                               eatlen -= mlen;
-                               mp = &m->m_next;
-                               m = m->m_next;
-                       }
                        while (m != NULL && M_READONLY(m) &&
                            n->m_type == m->m_type && eatlen > 0) {
                                mlen = min(eatlen, m->m_len);