Page MenuHomeFreeBSD

carp: Fix pullup checks
ClosedPublic

Authored by markj on Aug 30 2024, 4:59 PM.
Tags
None
Referenced Files
F131709925: D46492.id142633.diff
Fri, Oct 10, 1:16 PM
F131647440: D46492.diff
Fri, Oct 10, 12:47 AM
Unknown Object (File)
Tue, Oct 7, 6:15 AM
Unknown Object (File)
Sat, Sep 27, 3:37 AM
Unknown Object (File)
Thu, Sep 25, 2:57 PM
Unknown Object (File)
Wed, Sep 24, 10:11 PM
Unknown Object (File)
Mon, Sep 22, 8:24 PM
Unknown Object (File)
Mon, Sep 22, 8:00 PM

Details

Summary

The conditions used to test whether a pullup is needed were inverted.

While here:

  • Fix a bogus assignment to "iplen": it's already initialized to *offp.
  • Use in_cksum_skip() instead of manually adjusting the data pointer. Otherwise the mbuf is temporarily in an invalid state, since m_len isn't updated to match.

Reported by: KMSAN
Sponsored by: Klara, Inc.
Fixes: 37115154672f ("carp: support VRRPv3")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Aug 30 2024, 4:59 PM

Use in_cksum_skip() in carp6_input() as well.

This revision is now accepted and ready to land.Aug 30 2024, 7:55 PM
sys/netinet/ip_carp.c
597

This and the other in_cksum_skip() call is wrong. in_cksum_skip() has a weird interface: the offset should be included in the length, so we always have len >= off, and the function checksums len - off bytes.

Currently waiting for a test run to finish with this call changed to in_cksum_skip(m, totlen, iplen) and the one below changed to in_cksum_skip(m, sizeof(struct carp_header) + *offp, *offp).

This revision was automatically updated to reflect the committed changes.