Page MenuHomeFreeBSD
Files F171582353

D59332.diff
No OneTemporary
Actions

D59332.diff
View Options

diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -957,6 +957,8 @@
}
space = &m->m_dat[MLEN] - (m->m_data + m->m_len);
do {
+ KASSERT((n->m_flags & M_EXTPG) == 0,
+ ("%s: unmapped mbuf %p in chain", __func__, n));
count = min(min(max(len, max_protohdr), space), n->m_len);
bcopy(mtod(n, caddr_t), mtod(m, caddr_t) + m->m_len,
(u_int)count);
@@ -1001,6 +1003,8 @@
m->m_data += dstoff;
space = &m->m_dat[MLEN] - (m->m_data + m->m_len);
do {
+ KASSERT((n->m_flags & M_EXTPG) == 0,
+ ("%s: unmapped mbuf %p in chain", __func__, n));
count = min(min(max(len, max_protohdr), space), n->m_len);
memcpy(mtod(m, caddr_t) + m->m_len, mtod(n, caddr_t),
(unsigned)count);
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -3956,9 +3956,8 @@
if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0)
return (0); /* filtering is disabled */
- i = min((*mp)->m_pkthdr.len, max_protohdr);
- if ((*mp)->m_len < i) {
- *mp = m_pullup(*mp, i);
+ if ((*mp)->m_len < ETHER_HDR_LEN) {
+ *mp = m_pullup(*mp, ETHER_HDR_LEN);
if (*mp == NULL) {
printf("%s: m_pullup failed\n", __func__);
return (-1);
@@ -3972,14 +3971,28 @@
* Check for SNAP/LLC.
*/
if (ether_type < ETHERMTU) {
- struct llc *llc2 = (struct llc *)(eh1 + 1);
+ struct llc *llc2;
- if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
- llc2->llc_dsap == LLC_SNAP_LSAP &&
- llc2->llc_ssap == LLC_SNAP_LSAP &&
- llc2->llc_control == LLC_UI) {
- ether_type = htons(llc2->llc_un.type_snap.ether_type);
- snap = 1;
+ i = min((*mp)->m_pkthdr.len,
+ ETHER_HDR_LEN + sizeof(struct llc));
+ if ((*mp)->m_len < i) {
+ *mp = m_pullup(*mp, i);
+ if (*mp == NULL) {
+ printf("%s: m_pullup failed\n", __func__);
+ return (-1);
+ }
+ eh1 = mtod(*mp, struct ether_header *);
+ }
+
+ if ((*mp)->m_len >= ETHER_HDR_LEN + sizeof(struct llc)) {
+ llc2 = (struct llc *)(eh1 + 1);
+ if (llc2->llc_dsap == LLC_SNAP_LSAP &&
+ llc2->llc_ssap == LLC_SNAP_LSAP &&
+ llc2->llc_control == LLC_UI) {
+ ether_type =
+ htons(llc2->llc_un.type_snap.ether_type);
+ snap = 1;
+ }
}
}

File Metadata

Mime Type
text/plain
Expires
Sat, Sep 12, 9:53 PM (1 h, 45 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
38742263
Default Alt Text
D59332.diff (2 KB)

Event Timeline