Page MenuHomeFreeBSD

carp: Fix pullup checks
ClosedPublic

Authored by markj on Aug 30 2024, 4:59 PM.
Tags
None
Referenced Files
F132352950: D46492.id142630.diff
Thu, Oct 16, 4:14 AM
F132352939: D46492.id142633.diff
Thu, Oct 16, 4:14 AM
F132352917: D46492.id142672.diff
Thu, Oct 16, 4:14 AM
F132303643: D46492.diff
Wed, Oct 15, 5:13 PM
Unknown Object (File)
Sat, Oct 11, 3:43 AM
Unknown Object (File)
Sat, Oct 11, 12:08 AM
Unknown Object (File)
Fri, Oct 10, 1:16 PM
Unknown Object (File)
Fri, Oct 10, 12:47 AM

Details

Summary

The conditions used to test whether a pullup is needed were inverted.

While here:

  • Fix a bogus assignment to "iplen": it's already initialized to *offp.
  • Use in_cksum_skip() instead of manually adjusting the data pointer. Otherwise the mbuf is temporarily in an invalid state, since m_len isn't updated to match.

Reported by: KMSAN
Sponsored by: Klara, Inc.
Fixes: 37115154672f ("carp: support VRRPv3")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Aug 30 2024, 4:59 PM

Use in_cksum_skip() in carp6_input() as well.

This revision is now accepted and ready to land.Aug 30 2024, 7:55 PM
sys/netinet/ip_carp.c
597

This and the other in_cksum_skip() call is wrong. in_cksum_skip() has a weird interface: the offset should be included in the length, so we always have len >= off, and the function checksums len - off bytes.

Currently waiting for a test run to finish with this call changed to in_cksum_skip(m, totlen, iplen) and the one below changed to in_cksum_skip(m, sizeof(struct carp_header) + *offp, *offp).

This revision was automatically updated to reflect the committed changes.