Page MenuHomeFreeBSD

Fix KASSERT in tcp_output()
ClosedPublic

Authored by tuexen on Mar 23 2019, 6:55 AM.

Details

Reviewers
rrs
bz
Group Reviewers
transport
Summary

When checking the length of the headers at this point, the IP level options have not been added to the mbuf chain. So don't take them into account.

This issue was reported by

  • syzbot+16025fff7ee5f7c5957b@syzkaller.appspotmail.com
  • syzbot+adb5836b8a9ff621b2aa@syzkaller.appspotmail.com
  • syzbot+d25a5352bcdf40acdbb8@syzkaller.appspotmail.com
Test Plan

Run the attached packetdrill script:

Diff Detail

Repository
rS FreeBSD src repository
Lint
Lint Skipped
Unit
Unit Tests Skipped
Build Status
Buildable 23261

Event Timeline

tuexen created this revision.Mar 23 2019, 6:55 AM
rrs accepted this revision.Mar 23 2019, 9:52 AM
This revision is now accepted and ready to land.Mar 23 2019, 9:52 AM
tuexen closed this revision.Mar 23 2019, 9:20 PM

Committed in r345441.