Not an expert by any measure but the following looks suspicious: m_copy/m_copym calls mb_dupcl for M_EXT case and M_RDONLY is _not_ checked nor preserved in that case. So we may get a writable M_EXT mbuf pointing to sf_buf wrapping a page of a file. But I am not sure if/how mbufs are re-used and if we can end up actually writing something to the resulting mbuf.
-- Andriy Gapon _______________________________________________ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
