Page MenuHomeFreeBSD
Files F164921192

D58323.diff
No OneTemporary
Actions

D58323.diff
View Options

diff --git a/sys/dev/irdma/irdma_cm.c b/sys/dev/irdma/irdma_cm.c
--- a/sys/dev/irdma/irdma_cm.c
+++ b/sys/dev/irdma/irdma_cm.c
@@ -822,13 +822,20 @@
*/
static int
irdma_process_options(struct irdma_cm_node *cm_node, u8 *optionsloc,
- u32 optionsize, u32 syn_pkt)
+ int optionsize, u32 syn_pkt)
{
u32 tmp;
- u32 offset = 0;
+ int offset = 0;
union all_known_options *all_options;
char got_mss_option = 0;
+ if ((optionsize < 0) || (optionsize > MAX_TCPOPTLEN)) {
+ irdma_debug(&cm_node->iwdev->rf->sc_dev, IRDMA_DEBUG_CM,
+ "Option Size: %d out of bound\n",
+ optionsize);
+ /* return silently */
+ return 0;
+ }
while (offset < optionsize) {
all_options = (union all_known_options *)(optionsloc + offset);
switch (all_options->base.optionnum) {
@@ -2668,7 +2675,11 @@
u32 inc_sequence;
int optionsize;
+ if (tcph->th_off < 5) {
+ return;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
+
inc_sequence = ntohl(tcph->th_seq);
switch (cm_node->state) {
@@ -2736,7 +2747,11 @@
u32 inc_sequence;
int optionsize;
+ if (tcph->th_off < 5) {
+ return;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
+
inc_sequence = ntohl(tcph->th_seq);
switch (cm_node->state) {
case IRDMA_CM_STATE_SYN_SENT:
@@ -2811,6 +2826,9 @@
int optionsize;
u32 datasize = rbuf->datalen;
+ if (tcph->th_off < 5) {
+ return -EINVAL;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
if (irdma_check_seq(cm_node, tcph))
diff --git a/sys/dev/irdma/irdma_utils.c b/sys/dev/irdma/irdma_utils.c
--- a/sys/dev/irdma/irdma_utils.c
+++ b/sys/dev/irdma/irdma_utils.c
@@ -1541,6 +1541,13 @@
}
buf->tcphlen = tcph->th_off << 2;
+ if (buf->tcphlen < 20) {
+ irdma_debug(buf->vsi->dev, IRDMA_DEBUG_ERR,
+ "tcp hlen too small 0x%x\n",
+ buf->tcphlen);
+ return -EINVAL;
+ }
+
buf->datalen = pkt_len - iphlen - buf->tcphlen;
buf->data = buf->datalen ? buf->tcph + buf->tcphlen : NULL;
buf->hdrlen = buf->maclen + iphlen + buf->tcphlen;
@@ -1581,6 +1588,12 @@
pkt_len = info->payload_len;
buf->totallen = pkt_len;
buf->tcphlen = tcph->th_off << 2;
+ if (buf->tcphlen < 20) {
+ irdma_debug(buf->vsi->dev, IRDMA_DEBUG_ERR,
+ "tcp hlen too small 0x%x\n",
+ buf->tcphlen);
+ return -EINVAL;
+ }
buf->datalen = pkt_len - IRDMA_TCP_OFFSET - buf->tcphlen;
buf->data = buf->datalen ? buf->tcph + buf->tcphlen : NULL;
buf->hdrlen = IRDMA_TCP_OFFSET + buf->tcphlen;

File Metadata

Mime Type
text/plain
Expires
Wed, Aug 5, 8:44 PM (2 h, 59 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35890862
Default Alt Text
D58323.diff (2 KB)

Event Timeline