Page MenuHomeFreeBSD
Files F176046238

D60689.id189951.diff
No OneTemporary
Actions

D60689.id189951.diff
View Options

diff --git a/sys/net/bridgestp.c b/sys/net/bridgestp.c
--- a/sys/net/bridgestp.c
+++ b/sys/net/bridgestp.c
@@ -477,8 +477,7 @@
if (m->m_pkthdr.len > len)
m_adj(m, len - m->m_pkthdr.len);
- if (m->m_len < sizeof(tpdu) &&
- (m = m_pullup(m, sizeof(tpdu))) == NULL)
+ if ((m = m_pullup(m, sizeof(tpdu))) == NULL)
goto out;
memcpy(&tpdu, mtod(m, char *), sizeof(tpdu));
@@ -543,8 +542,7 @@
bstp_received_tcn(bs, bp, &tu);
break;
case BSTP_MSGTYPE_CFG:
- if ((*mp)->m_len < BSTP_BPDU_STP_LEN &&
- (*mp = m_pullup(*mp, BSTP_BPDU_STP_LEN)) == NULL)
+ if ((*mp = m_pullup(*mp, BSTP_BPDU_STP_LEN)) == NULL)
return;
memcpy(&cpdu, mtod(*mp, char *), BSTP_BPDU_STP_LEN);
@@ -564,8 +562,7 @@
if (tpdu->tbu_bpdutype != BSTP_MSGTYPE_RSTP)
return;
- if ((*mp)->m_len < BSTP_BPDU_RSTP_LEN &&
- (*mp = m_pullup(*mp, BSTP_BPDU_RSTP_LEN)) == NULL)
+ if ((*mp = m_pullup(*mp, BSTP_BPDU_RSTP_LEN)) == NULL)
return;
memcpy(&cpdu, mtod(*mp, char *), BSTP_BPDU_RSTP_LEN);
diff --git a/sys/net/debugnet.c b/sys/net/debugnet.c
--- a/sys/net/debugnet.c
+++ b/sys/net/debugnet.c
@@ -391,13 +391,9 @@
}
/* Get ND header. */
- if (m->m_len < sizeof(*dnh)) {
- m = m_pullup(m, sizeof(*dnh));
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, sizeof(*dnh))) == NULL) {
+ DNETDEBUG("m_pullup failed\n");
+ return;
}
dnh = mtod(m, const struct debugnet_msg_hdr *);
@@ -451,13 +447,9 @@
m = *mb;
/* Get Ack. */
- if (m->m_len < sizeof(*dn_ack)) {
- m = m_pullup(m, sizeof(*dn_ack));
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, sizeof(*dn_ack))) == NULL) {
+ DNETDEBUG("m_pullup failed\n");
+ return;
}
dn_ack = mtod(m, const struct debugnet_ack *);
@@ -495,13 +487,9 @@
}
/* Get UDP headers. */
- if (m->m_len < sizeof(*udp)) {
- m = m_pullup(m, sizeof(*udp));
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, sizeof(*udp))) == NULL) {
+ DNETDEBUG("m_pullup failed\n");
+ return;
}
udp = mtod(m, const struct udphdr *);
diff --git a/sys/net/debugnet_inet.c b/sys/net/debugnet_inet.c
--- a/sys/net/debugnet_inet.c
+++ b/sys/net/debugnet_inet.c
@@ -93,13 +93,9 @@
DNETDEBUG("dropping packet too small for IP header\n");
return;
}
- if (m->m_len < sizeof(struct ip)) {
- m = m_pullup(m, sizeof(struct ip));
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, sizeof(struct ip))) == NULL) {
+ DNETDEBUG("m_pullup failed\n");
+ return;
}
ip = mtod(m, struct ip *);
@@ -115,15 +111,11 @@
DNETDEBUG("bad IP header length (%hu)\n", hlen);
return;
}
- if (hlen > m->m_len) {
- m = m_pullup(m, hlen);
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("m_pullup failed\n");
- return;
- }
- ip = mtod(m, struct ip *);
+ if ((*mb = m = m_pullup(m, hlen)) == NULL) {
+ DNETDEBUG("m_pullup failed\n");
+ return;
}
+ ip = mtod(m, struct ip *);
/* Ignore packets with IP options. */
if (hlen > sizeof(struct ip)) {
DNETDEBUG("drop packet with IP options\n");
@@ -287,13 +279,9 @@
m = *mb;
ifp = m->m_pkthdr.rcvif;
- if (m->m_len < sizeof(struct arphdr)) {
- m = m_pullup(m, sizeof(struct arphdr));
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("runt packet: m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, sizeof(struct arphdr))) == NULL) {
+ DNETDEBUG("runt packet: m_pullup failed\n");
+ return;
}
ah = mtod(m, struct arphdr *);
@@ -308,13 +296,9 @@
return;
}
req_len = arphdr_len2(ifp->if_addrlen, sizeof(struct in_addr));
- if (m->m_len < req_len) {
- m = m_pullup(m, req_len);
- *mb = m;
- if (m == NULL) {
- DNETDEBUG("runt packet: m_pullup failed\n");
- return;
- }
+ if ((*mb = m = m_pullup(m, req_len)) == NULL) {
+ DNETDEBUG("runt packet: m_pullup failed\n");
+ return;
}
ah = mtod(m, struct arphdr *);
diff --git a/sys/net/ieee8023ad_lacp.c b/sys/net/ieee8023ad_lacp.c
--- a/sys/net/ieee8023ad_lacp.c
+++ b/sys/net/ieee8023ad_lacp.c
@@ -279,12 +279,8 @@
goto bad;
}
- if (m->m_len < sizeof(*du)) {
- m = m_pullup(m, sizeof(*du));
- if (m == NULL) {
- return (ENOMEM);
- }
- }
+ if ((m = m_pullup(m, sizeof(*du))) == NULL)
+ return (ENOMEM);
du = mtod(m, struct lacpdu *);
@@ -1922,12 +1918,8 @@
goto bad;
}
- if (m->m_len < sizeof(*mdu)) {
- m = m_pullup(m, sizeof(*mdu));
- if (m == NULL) {
- return (ENOMEM);
- }
- }
+ if ((m = m_pullup(m, sizeof(*mdu))) == NULL)
+ return (ENOMEM);
mdu = mtod(m, struct markerdu *);
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -2520,11 +2520,8 @@
NET_EPOCH_ASSERT();
- if (m->m_len < ETHER_HDR_LEN) {
- m = m_pullup(m, ETHER_HDR_LEN);
- if (m == NULL)
- return (0);
- }
+ if ((m = m_pullup(m, ETHER_HDR_LEN)) == NULL)
+ return (0);
sbif = ifp->if_bridge;
sc = sbif->bif_sc;
@@ -2855,11 +2852,8 @@
NET_EPOCH_ASSERT();
/* We need the Ethernet header later, so make sure we have it now. */
- if (m->m_len < ETHER_HDR_LEN) {
- m = m_pullup(m, ETHER_HDR_LEN);
- if (m == NULL)
- return (NULL);
- }
+ if ((m = m_pullup(m, ETHER_HDR_LEN)) == NULL)
+ return (NULL);
eh = mtod(m, struct ether_header *);
vlan = VLANTAGOF(m);
@@ -3957,12 +3951,9 @@
if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0)
return (0); /* filtering is disabled */
- if ((*mp)->m_len < ETHER_HDR_LEN) {
- *mp = m_pullup(*mp, ETHER_HDR_LEN);
- if (*mp == NULL) {
+ if ((*mp = m_pullup(*mp, ETHER_HDR_LEN)) == NULL) {
printf("%s: m_pullup failed\n", __func__);
return (-1);
- }
}
eh1 = mtod(*mp, struct ether_header *);
@@ -3976,14 +3967,11 @@
i = min((*mp)->m_pkthdr.len,
ETHER_HDR_LEN + sizeof(struct llc));
- if ((*mp)->m_len < i) {
- *mp = m_pullup(*mp, i);
- if (*mp == NULL) {
- printf("%s: m_pullup failed\n", __func__);
- return (-1);
- }
- eh1 = mtod(*mp, struct ether_header *);
+ if ((*mp = m_pullup(*mp, i)) == NULL) {
+ printf("%s: m_pullup failed\n", __func__);
+ return (-1);
}
+ eh1 = mtod(*mp, struct ether_header *);
if ((*mp)->m_len >= ETHER_HDR_LEN + sizeof(struct llc)) {
llc2 = (struct llc *)(eh1 + 1);
@@ -4130,13 +4118,9 @@
hlen = ip->ip_hl << 2;
if (hlen < sizeof(struct ip))
goto bad;
- if (hlen > (*mp)->m_len) {
- if ((*mp = m_pullup(*mp, hlen)) == NULL)
- goto bad;
- ip = mtod(*mp, struct ip *);
- if (ip == NULL)
- goto bad;
- }
+ if ((*mp = m_pullup(*mp, hlen)) == NULL)
+ goto bad;
+ ip = mtod(*mp, struct ip *);
ip->ip_sum = 0;
if (hlen == sizeof(struct ip))
ip->ip_sum = in_cksum_hdr(ip);
@@ -4233,11 +4217,9 @@
KMOD_IPSTAT_INC(ips_toosmall);
goto bad;
}
- } else if (__predict_false(m->m_len < sizeof (struct ip))) {
- if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
- KMOD_IPSTAT_INC(ips_toosmall);
- goto bad;
- }
+ } else if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
+ KMOD_IPSTAT_INC(ips_toosmall);
+ goto bad;
}
ip = mtod(m, struct ip *);
if (ip == NULL) goto bad;
@@ -4251,14 +4233,11 @@
KMOD_IPSTAT_INC(ips_badhlen);
goto bad;
}
- if (hlen > m->m_len) {
- if ((m = m_pullup(m, hlen)) == NULL) {
- KMOD_IPSTAT_INC(ips_badhlen);
- goto bad;
- }
- ip = mtod(m, struct ip *);
- if (ip == NULL) goto bad;
+ if ((m = m_pullup(m, hlen)) == NULL) {
+ KMOD_IPSTAT_INC(ips_badhlen);
+ goto bad;
}
+ ip = mtod(m, struct ip *);
if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
@@ -4315,6 +4294,7 @@
bridge_ip6_checkbasic(struct mbuf **mp)
{
struct mbuf *m = *mp;
+ struct ifnet *inifp = m->m_pkthdr.rcvif;
struct ip6_hdr *ip6;
/*
@@ -4324,7 +4304,6 @@
* IPv6 header is in the first mbuf of the chain.
*/
if (IP6_HDR_ALIGNED_P(mtod(m, char *)) == 0) {
- struct ifnet *inifp = m->m_pkthdr.rcvif;
if ((m = m_copyup(m, sizeof(struct ip6_hdr),
(max_linkhdr + 3) & ~3)) == NULL) {
/* XXXJRT new stat, please */
@@ -4332,13 +4311,10 @@
in6_ifstat_inc(inifp, ifs6_in_hdrerr);
goto bad;
}
- } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
- struct ifnet *inifp = m->m_pkthdr.rcvif;
- if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
- IP6STAT_INC(ip6s_toosmall);
- in6_ifstat_inc(inifp, ifs6_in_hdrerr);
- goto bad;
- }
+ } else if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_toosmall);
+ in6_ifstat_inc(inifp, ifs6_in_hdrerr);
+ goto bad;
}
ip6 = mtod(m, struct ip6_hdr *);
@@ -4373,8 +4349,7 @@
struct ip *ip;
int error = -1;
- if (m->m_len < sizeof(struct ip) &&
- (m = m_pullup(m, sizeof(struct ip))) == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL) {
KMOD_IPSTAT_INC(ips_odropped);
goto dropit;
}
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -575,8 +575,7 @@
((etype == ETHERTYPE_VLAN) || (etype == ETHERTYPE_QINQ))) {
struct ether_vlan_header *evl;
- if (m->m_len < sizeof(*evl) &&
- (m = m_pullup(m, sizeof(*evl))) == NULL) {
+ if ((m = m_pullup(m, sizeof(*evl))) == NULL) {
#ifdef DIAGNOSTIC
if_printf(ifp, "cannot pullup VLAN header\n");
#endif
@@ -1259,11 +1258,8 @@
return (NULL);
/* M_PREPEND takes care of m_len, m_pkthdr.len for us */
- if (m->m_len < sizeof(*evl)) {
- m = m_pullup(m, sizeof(*evl));
- if (m == NULL)
- return (NULL);
- }
+ if ((m = m_pullup(m, sizeof(*evl))) == NULL)
+ return (NULL);
/*
* Transform the Ethernet header into an Ethernet header
diff --git a/sys/net/if_geneve.c b/sys/net/if_geneve.c
--- a/sys/net/if_geneve.c
+++ b/sys/net/if_geneve.c
@@ -3096,18 +3096,14 @@
if (m->m_pkthdr.len < ETHER_HDR_LEN)
return (EINVAL);
- if (m->m_len < ETHER_HDR_LEN &&
- (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
- *m0 = NULL;
+ if ((*m0 = m = m_pullup(m, ETHER_HDR_LEN)) == NULL)
return (ENOBUFS);
- }
eh = mtod(m, struct ether_header *);
info->ethertype = ntohs(eh->ether_type);
if (sc->gnv_flags & GENEVE_FLAG_LEARN)
geneve_ftable_learn(sc, sa, eh->ether_shost);
- *m0 = m;
return (0);
}
@@ -3128,8 +3124,7 @@
if (m->m_pkthdr.len < offset)
return (EINVAL);
- if (m->m_len < offset &&
- (*m0 = m = m_pullup(m, offset)) == NULL)
+ if ((*m0 = m = m_pullup(m, offset)) == NULL)
return (ENOBUFS);
iphdr = mtodo(m, offset - sizeof(struct ip));
@@ -3147,8 +3142,7 @@
if (m->m_pkthdr.len < offset)
return (EINVAL);
- if (m->m_len < offset &&
- (*m0 = m = m_pullup(m, offset)) == NULL)
+ if ((*m0 = m = m_pullup(m, offset)) == NULL)
return (ENOBUFS);
ip6hdr = mtodo(m, offset - sizeof(struct ip6_hdr));
@@ -3171,8 +3165,7 @@
if (m->m_pkthdr.len < offset)
return (EINVAL);
- if (m->m_len < offset &&
- (*m0 = m = m_pullup(m, offset)) == NULL)
+ if ((*m0 = m = m_pullup(m, offset)) == NULL)
return (ENOBUFS);
info->isr = NETISR_ARP;
break;
diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -470,9 +470,7 @@
#ifdef INET
case AF_INET:
proto = IPPROTO_IPV4;
- if (m->m_len < sizeof(struct ip))
- m = m_pullup(m, sizeof(struct ip));
- if (m == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL) {
error = ENOBUFS;
goto err;
}
@@ -484,9 +482,7 @@
#ifdef INET6
case AF_INET6:
proto = IPPROTO_IPV6;
- if (m->m_len < sizeof(struct ip6_hdr))
- m = m_pullup(m, sizeof(struct ip6_hdr));
- if (m == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
error = ENOBUFS;
goto err;
}
@@ -592,9 +588,7 @@
#ifdef INET
case IPPROTO_IPV4:
af = AF_INET;
- if (m->m_len < sizeof(struct ip))
- m = m_pullup(m, sizeof(struct ip));
- if (m == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL)
goto drop;
ip = mtod(m, struct ip *);
if (ip_ecn_egress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED:
@@ -607,9 +601,7 @@
#ifdef INET6
case IPPROTO_IPV6:
af = AF_INET6;
- if (m->m_len < sizeof(struct ip6_hdr))
- m = m_pullup(m, sizeof(struct ip6_hdr));
- if (m == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL)
goto drop;
t = htonl((uint32_t)ecn << 20);
ip6 = mtod(m, struct ip6_hdr *);
@@ -675,9 +667,7 @@
case AF_LINK:
n = sizeof(struct etherip_header) +
sizeof(struct ether_header);
- if (n > m->m_len)
- m = m_pullup(m, n);
- if (m == NULL)
+ if ((m = m_pullup(m, n)) == NULL)
goto drop;
eip = mtod(m, struct etherip_header *);
if (eip->eip_ver != ETHERIP_VERSION) {
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -756,11 +756,8 @@
hlen = off + sizeof(struct grehdr) + 4 * sizeof(uint32_t);
if (m->m_pkthdr.len < hlen)
goto drop;
- if (m->m_len < hlen) {
- m = m_pullup(m, hlen);
- if (m == NULL)
- goto drop;
- }
+ if ((m = m_pullup(m, hlen)) == NULL)
+ goto drop;
gh = (struct grehdr *)mtodo(m, off);
flags = ntohs(gh->gre_flags);
if (flags & ~GRE_FLAGS_MASK)
diff --git a/sys/net/if_me.c b/sys/net/if_me.c
--- a/sys/net/if_me.c
+++ b/sys/net/if_me.c
@@ -480,9 +480,7 @@
hlen = sizeof(struct mobhdr);
if (m->m_pkthdr.len < sizeof(struct ip) + hlen)
hlen -= sizeof(struct in_addr);
- if (m->m_len < sizeof(struct ip) + hlen)
- m = m_pullup(m, sizeof(struct ip) + hlen);
- if (m == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip) + hlen)) == NULL)
goto drop;
mh = (struct mobhdr *)mtodo(m, sizeof(struct ip));
/* check for wrong flags */
@@ -581,9 +579,7 @@
m_freem(m);
goto drop;
}
- if (m->m_len < sizeof(struct ip))
- m = m_pullup(m, sizeof(struct ip));
- if (m == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL) {
error = ENOBUFS;
goto drop;
}
@@ -615,9 +611,7 @@
error = ENOBUFS;
goto drop;
}
- if (m->m_len < sizeof(struct ip) + hlen)
- m = m_pullup(m, sizeof(struct ip) + hlen);
- if (m == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip) + hlen)) == NULL) {
error = ENOBUFS;
goto drop;
}
diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c
--- a/sys/net/if_stf.c
+++ b/sys/net/if_stf.c
@@ -537,14 +537,10 @@
return (ENETDOWN);
}
- if (m->m_len < sizeof(*ip6)) {
- m = m_pullup(m, sizeof(*ip6));
- if (!m) {
- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
- SDT_PROBE2(if_stf, , stf_output, error, ENOBUFS,
- __LINE__);
- return (ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(*ip6))) == NULL) {
+ if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
+ SDT_PROBE2(if_stf, , stf_output, error, ENOBUFS, __LINE__);
+ return (ENOBUFS);
}
ip6 = mtod(m, struct ip6_hdr *);
tos = IPV6_TRAFFIC_CLASS(ip6);
@@ -762,13 +758,9 @@
otos = ip.ip_tos;
m_adj(m, off);
- if (m->m_len < sizeof(*ip6)) {
- m = m_pullup(m, sizeof(*ip6));
- if (!m) {
- SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE,
- __LINE__);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, sizeof(*ip6))) == NULL) {
+ SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
diff --git a/sys/net/if_tuntap.c b/sys/net/if_tuntap.c
--- a/sys/net/if_tuntap.c
+++ b/sys/net/if_tuntap.c
@@ -2005,8 +2005,7 @@
TUN_LOCK(tp);
if (tp->tun_flags & TUN_IFHEAD) {
TUN_UNLOCK(tp);
- if (m->m_len < sizeof(family) &&
- (m = m_pullup(m, sizeof(family))) == NULL)
+ if ((m = m_pullup(m, sizeof(family))) == NULL)
return (ENOBUFS);
family = ntohl(*mtod(m, u_int32_t *));
m_adj(m, sizeof(family));
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -1569,8 +1569,7 @@
*/
switch (ifp->if_type) {
case IFT_ETHER:
- if (m->m_len < sizeof(*evl) &&
- (m = m_pullup(m, sizeof(*evl))) == NULL) {
+ if ((m = m_pullup(m, sizeof(*evl))) == NULL) {
if_printf(ifp, "cannot pullup VLAN header\n");
return;
}
diff --git a/sys/net/if_vxlan.c b/sys/net/if_vxlan.c
--- a/sys/net/if_vxlan.c
+++ b/sys/net/if_vxlan.c
@@ -2875,8 +2875,7 @@
return (ENOENT);
ifp = sc->vxl_ifp;
- if (m->m_len < ETHER_HDR_LEN &&
- (m = *m0 = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
+ if ((m = *m0 = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
error = ENOBUFS;
goto out;
}
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1085,8 +1085,7 @@
fibnum = so->so_fibnum;
#define senderr(e) { error = e; goto flush;}
- if (m == NULL || ((m->m_len < sizeof(long)) &&
- (m = m_pullup(m, sizeof(long))) == NULL))
+ if (m == NULL || (m = m_pullup(m, sizeof(long))) == NULL)
return (ENOBUFS);
if ((m->m_flags & M_PKTHDR) == 0)
panic("route_output");
diff --git a/sys/net80211/ieee80211_adhoc.c b/sys/net80211/ieee80211_adhoc.c
--- a/sys/net80211/ieee80211_adhoc.c
+++ b/sys/net80211/ieee80211_adhoc.c
@@ -452,8 +452,7 @@
switch (type) {
case IEEE80211_FC0_TYPE_DATA:
hdrspace = ieee80211_hdrspace(ic, wh);
- if (m->m_len < hdrspace &&
- (m = m_pullup(m, hdrspace)) == NULL) {
+ if ((m = m_pullup(m, hdrspace)) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
"data too short: expecting %u", hdrspace);
diff --git a/sys/net80211/ieee80211_hostap.c b/sys/net80211/ieee80211_hostap.c
--- a/sys/net80211/ieee80211_hostap.c
+++ b/sys/net80211/ieee80211_hostap.c
@@ -582,8 +582,7 @@
switch (type) {
case IEEE80211_FC0_TYPE_DATA:
hdrspace = ieee80211_hdrspace(ic, wh);
- if (m->m_len < hdrspace &&
- (m = m_pullup(m, hdrspace)) == NULL) {
+ if ((m = m_pullup(m, hdrspace)) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
"data too short: expecting %u", hdrspace);
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c
--- a/sys/net80211/ieee80211_input.c
+++ b/sys/net80211/ieee80211_input.c
@@ -319,8 +319,7 @@
KASSERT(hdrlen <= sizeof(wh),
("hdrlen %d > max %zd", hdrlen, sizeof(wh)));
- if (m->m_len < hdrlen + sizeof(*llc) &&
- (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
+ if ((m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
vap->iv_stats.is_rx_tooshort++;
/* XXX msg */
return NULL;
@@ -395,7 +394,7 @@
* copy the 802.3 header up to where it belongs and
* adjust the mbuf contents to remove the void.
*/
- if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
+ if ((m = m_pullup(m, FF_LLC_SIZE)) == NULL)
return NULL;
eh = mtod(m, struct ether_header *); /* 802.3 header is first */
diff --git a/sys/net80211/ieee80211_mesh.c b/sys/net80211/ieee80211_mesh.c
--- a/sys/net80211/ieee80211_mesh.c
+++ b/sys/net80211/ieee80211_mesh.c
@@ -1258,8 +1258,7 @@
struct llc *llc;
int ae;
- if (m->m_len < hdrlen + sizeof(*llc) &&
- (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
+ if ((m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
"discard data frame: %s", "m_pullup failed");
vap->iv_stats.is_rx_tooshort++;
@@ -1673,9 +1672,8 @@
}
/* pull up enough to get to the mesh control */
- if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
- (m = m_pullup(m, hdrspace +
- sizeof(struct ieee80211_meshcntl))) == NULL) {
+ if ((m = m_pullup(m, hdrspace +
+ sizeof(struct ieee80211_meshcntl))) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
"data too short: expecting %u", hdrspace);
@@ -1696,7 +1694,6 @@
/* pull complete hdrspace = ieee80211_hdrspace + meshcontrol */
if ((meshdrlen > sizeof(struct ieee80211_meshcntl)) &&
- (m->m_len < hdrspace) &&
((m = m_pullup(m, hdrspace)) == NULL)) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -365,8 +365,7 @@
* mbuf has the 802.3 header present (and contiguous).
*/
ni = NULL;
- if (m->m_len < sizeof(struct ether_header) &&
- (m = m_pullup(m, sizeof(struct ether_header))) == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ether_header))) == NULL) {
IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
"discard frame, %s\n", "m_pullup failed");
vap->iv_stats.is_tx_nobuf++; /* XXX */
diff --git a/sys/net80211/ieee80211_sta.c b/sys/net80211/ieee80211_sta.c
--- a/sys/net80211/ieee80211_sta.c
+++ b/sys/net80211/ieee80211_sta.c
@@ -657,8 +657,7 @@
switch (type) {
case IEEE80211_FC0_TYPE_DATA:
hdrspace = ieee80211_hdrspace(ic, wh);
- if (m->m_len < hdrspace &&
- (m = m_pullup(m, hdrspace)) == NULL) {
+ if ((m = m_pullup(m, hdrspace)) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
"data too short: expecting %u", hdrspace);
diff --git a/sys/net80211/ieee80211_superg.c b/sys/net80211/ieee80211_superg.c
--- a/sys/net80211/ieee80211_superg.c
+++ b/sys/net80211/ieee80211_superg.c
@@ -285,8 +285,7 @@
*/
if (m->m_pkthdr.len < 3*FF_LLC_SIZE)
return m;
- if (m->m_len < FF_LLC_SIZE &&
- (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
+ if ((m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, "fast-frame",
"%s", "m_pullup(llc) failed");
diff --git a/sys/net80211/ieee80211_wds.c b/sys/net80211/ieee80211_wds.c
--- a/sys/net80211/ieee80211_wds.c
+++ b/sys/net80211/ieee80211_wds.c
@@ -508,8 +508,7 @@
switch (type) {
case IEEE80211_FC0_TYPE_DATA:
hdrspace = ieee80211_hdrspace(ic, wh);
- if (m->m_len < hdrspace &&
- (m = m_pullup(m, hdrspace)) == NULL) {
+ if ((m = m_pullup(m, hdrspace)) == NULL) {
IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
ni->ni_macaddr, NULL,
"data too short: expecting %u", hdrspace);
diff --git a/sys/netgraph/bluetooth/hci/ng_hci_var.h b/sys/netgraph/bluetooth/hci/ng_hci_var.h
--- a/sys/netgraph/bluetooth/hci/ng_hci_var.h
+++ b/sys/netgraph/bluetooth/hci/ng_hci_var.h
@@ -51,9 +51,7 @@
/* Wrapper around m_pullup */
#define NG_HCI_M_PULLUP(m, s) \
do { \
- if ((m)->m_len < (s)) \
- (m) = m_pullup((m), (s)); \
- if ((m) == NULL) \
+ if (((m) = m_pullup((m), (s))) == NULL) \
NG_HCI_ALERT("%s: %s - m_pullup(%zd) failed\n", \
__func__, NG_NODE_NAME(unit->node), (s)); \
} while (0)
diff --git a/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c b/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
--- a/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
+++ b/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
@@ -594,7 +594,7 @@
ng_l2cap_prepend(struct mbuf *m, int size)
{
M_PREPEND(m, size, M_NOWAIT);
- if (m == NULL || (m->m_len < size && (m = m_pullup(m, size)) == NULL))
+ if (m == NULL || (m = m_pullup(m, size)) == NULL)
return (NULL);
return (m);
diff --git a/sys/netgraph/bluetooth/l2cap/ng_l2cap_var.h b/sys/netgraph/bluetooth/l2cap/ng_l2cap_var.h
--- a/sys/netgraph/bluetooth/l2cap/ng_l2cap_var.h
+++ b/sys/netgraph/bluetooth/l2cap/ng_l2cap_var.h
@@ -51,9 +51,7 @@
/* Wrapper around m_pullup */
#define NG_L2CAP_M_PULLUP(m, s) \
do { \
- if ((m)->m_len < (s)) \
- (m) = m_pullup((m), (s)); \
- if ((m) == NULL) \
+ if (((m) = m_pullup((m), (s))) == NULL) \
NG_L2CAP_ALERT("%s: %s - m_pullup(%zd) failed\n", \
__func__, NG_NODE_NAME(l2cap->node), (s)); \
} while (0)
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c b/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
@@ -1586,11 +1586,9 @@
goto drop;
}
- if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
- if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
- error = ENOBUFS;
- goto drop;
- }
+ if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
+ error = ENOBUFS;
+ goto drop;
}
if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
error = ENOTSUP;
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
@@ -1431,11 +1431,8 @@
goto drop;
}
- if (m->m_len < sizeof(*hdr)) {
- m = m_pullup(m, sizeof(*hdr));
- if (m == NULL)
- goto drop;
- }
+ if ((m = m_pullup(m, sizeof(*hdr))) == NULL)
+ goto drop;
/* Strip L2CAP packet header and verify packet length */
hdr = mtod(m, ng_l2cap_hdr_t *);
@@ -1568,11 +1565,8 @@
goto drop;
}
- if (m->m_len < sizeof(*clt_hdr)) {
- m = m_pullup(m, sizeof(*clt_hdr));
- if (m == NULL)
- goto drop;
- }
+ if ((m = m_pullup(m, sizeof(*clt_hdr))) == NULL)
+ goto drop;
/* Strip connectionless header and deliver packet */
clt_hdr = mtod(m, ng_l2cap_clt_hdr_t *);
@@ -2644,8 +2638,7 @@
/* Create L2CA packet header */
M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
if (m != NULL)
- if (m->m_len < sizeof(*hdr))
- m = m_pullup(m, sizeof(*hdr));
+ m = m_pullup(m, sizeof(*hdr));
if (m == NULL) {
NG_BTSOCKET_L2CAP_ERR(
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c b/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
@@ -1823,13 +1823,10 @@
/* Pullup as much as we can into first mbuf (for direct access) */
length = min(m0->m_pkthdr.len, MHLEN);
- if (m0->m_len < length) {
- if ((m0 = m_pullup(m0, length)) == NULL) {
- NG_BTSOCKET_RFCOMM_ALERT(
-"%s: m_pullup(%d) failed\n", __func__, length);
-
- return (ENOBUFS);
- }
+ if ((m0 = m_pullup(m0, length)) == NULL) {
+ NG_BTSOCKET_RFCOMM_ALERT("%s: m_pullup(%d) failed\n",
+ __func__, length);
+ return (ENOBUFS);
}
hdr = mtod(m0, struct rfcomm_frame_hdr *);
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_sco.c b/sys/netgraph/bluetooth/socket/ng_btsocket_sco.c
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_sco.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_sco.c
@@ -721,11 +721,8 @@
goto drop;
}
- if (m->m_len < sizeof(*hdr)) {
- m = m_pullup(m, sizeof(*hdr));
- if (m == NULL)
- goto drop;
- }
+ if ((m = m_pullup(m, sizeof(*hdr))) == NULL)
+ goto drop;
/* Strip SCO packet header and verify packet length */
hdr = mtod(m, ng_hci_scodata_pkt_t *);
@@ -1736,8 +1733,7 @@
/* Create SCO packet header */
M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
if (m != NULL)
- if (m->m_len < sizeof(*hdr))
- m = m_pullup(m, sizeof(*hdr));
+ m = m_pullup(m, sizeof(*hdr));
if (m == NULL) {
error = ENOBUFS;
diff --git a/sys/netgraph/netflow/ng_netflow.c b/sys/netgraph/netflow/ng_netflow.c
--- a/sys/netgraph/netflow/ng_netflow.c
+++ b/sys/netgraph/netflow/ng_netflow.c
@@ -680,14 +680,13 @@
*/
#define M_CHECK(length) do { \
- pullup_len += length; \
- if (((m)->m_pkthdr.len < (pullup_len)) || \
- ((pullup_len) > MHLEN)) { \
+ pullup_len += (length); \
+ if ((m->m_pkthdr.len < pullup_len) || \
+ (pullup_len > MHLEN)) { \
error = EINVAL; \
goto bypass; \
} \
- if ((m)->m_len < (pullup_len) && \
- (((m) = m_pullup((m),(pullup_len))) == NULL)) { \
+ if ((m = m_pullup(m, pullup_len)) == NULL) { \
error = ENOBUFS; \
goto done; \
} \
diff --git a/sys/netgraph/ng_UI.c b/sys/netgraph/ng_UI.c
--- a/sys/netgraph/ng_UI.c
+++ b/sys/netgraph/ng_UI.c
@@ -173,8 +173,7 @@
if (hook == priv->downlink) {
u_char *start, *ptr;
- if (m->m_len < MAX_ENCAPS_HDR
- && !(m = m_pullup(m, MAX_ENCAPS_HDR)))
+ if ((m = m_pullup(m, MAX_ENCAPS_HDR)) == NULL)
ERROUT(ENOBUFS);
ptr = start = mtod(m, u_char *);
diff --git a/sys/netgraph/ng_bridge.c b/sys/netgraph/ng_bridge.c
--- a/sys/netgraph/ng_bridge.c
+++ b/sys/netgraph/ng_bridge.c
@@ -817,7 +817,7 @@
NG_FREE_M(ctx.m);
return (EINVAL);
}
- if (ctx.m->m_len < ETHER_HDR_LEN && !(ctx.m = m_pullup(ctx.m, ETHER_HDR_LEN))) {
+ if ((ctx.m = m_pullup(ctx.m, ETHER_HDR_LEN)) == NULL) {
counter_u64_add(ctx.incoming->stats.memoryFailures, 1);
NG_FREE_ITEM(item);
return (ENOBUFS);
diff --git a/sys/netgraph/ng_checksum.c b/sys/netgraph/ng_checksum.c
--- a/sys/netgraph/ng_checksum.c
+++ b/sys/netgraph/ng_checksum.c
@@ -289,13 +289,12 @@
}
#define PULLUP_CHECK(mbuf, length) do { \
- pullup_len += length; \
+ pullup_len += (length); \
if (((mbuf)->m_pkthdr.len < pullup_len) || \
(pullup_len > MHLEN)) { \
return (EINVAL); \
} \
- if ((mbuf)->m_len < pullup_len && \
- (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL)) { \
+ if (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL) { \
return (ENOBUFS); \
} \
} while (0)
@@ -548,14 +547,13 @@
NGI_GET_M(item, m);
#define PULLUP_CHECK(mbuf, length) do { \
- pullup_len += length; \
+ pullup_len += (length); \
if (((mbuf)->m_pkthdr.len < pullup_len) || \
(pullup_len > MHLEN)) { \
error = EINVAL; \
goto bypass; \
} \
- if ((mbuf)->m_len < pullup_len && \
- (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL)) { \
+ if (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL) { \
error = ENOBUFS; \
goto drop; \
} \
diff --git a/sys/netgraph/ng_eiface.c b/sys/netgraph/ng_eiface.c
--- a/sys/netgraph/ng_eiface.c
+++ b/sys/netgraph/ng_eiface.c
@@ -584,11 +584,8 @@
return (ENETDOWN);
}
- if (m->m_len < ETHER_HDR_LEN) {
- m = m_pullup(m, ETHER_HDR_LEN);
- if (m == NULL)
- return (EINVAL);
- }
+ if ((m = m_pullup(m, ETHER_HDR_LEN)) == NULL)
+ return (EINVAL);
/* Note receiving interface */
m->m_pkthdr.rcvif = ifp;
diff --git a/sys/netgraph/ng_etf.c b/sys/netgraph/ng_etf.c
--- a/sys/netgraph/ng_etf.c
+++ b/sys/netgraph/ng_etf.c
@@ -380,12 +380,9 @@
/* Make sure we have an entire header */
NGI_GET_M(item, m);
- if (m->m_len < sizeof(*eh) ) {
- m = m_pullup(m, sizeof(*eh));
- if (m == NULL) {
- NG_FREE_ITEM(item);
- return(EINVAL);
- }
+ if ((m = m_pullup(m, sizeof(*eh))) == NULL) {
+ NG_FREE_ITEM(item);
+ return(EINVAL);
}
eh = mtod(m, struct ether_header *);
diff --git a/sys/netgraph/ng_ether.c b/sys/netgraph/ng_ether.c
--- a/sys/netgraph/ng_ether.c
+++ b/sys/netgraph/ng_ether.c
@@ -688,8 +688,7 @@
NG_FREE_M(m);
return (EINVAL);
}
- if (m->m_len < sizeof(struct ether_header)
- && (m = m_pullup(m, sizeof(struct ether_header))) == NULL)
+ if ((m = m_pullup(m, sizeof(struct ether_header))) == NULL)
return (ENOBUFS);
/* Drop in the MAC address if desired */
@@ -728,8 +727,7 @@
NG_FREE_M(m);
return (EINVAL);
}
- if (m->m_len < sizeof(struct ether_header) &&
- (m = m_pullup(m, sizeof(struct ether_header))) == NULL)
+ if ((m = m_pullup(m, sizeof(struct ether_header))) == NULL)
return (ENOBUFS);
m->m_pkthdr.rcvif = ifp;
diff --git a/sys/netgraph/ng_ether_echo.c b/sys/netgraph/ng_ether_echo.c
--- a/sys/netgraph/ng_ether_echo.c
+++ b/sys/netgraph/ng_ether_echo.c
@@ -110,12 +110,9 @@
/* Make sure we have an entire header */
NGI_GET_M(item, m);
- if (m->m_len < sizeof(*eh) ) {
- m = m_pullup(m, sizeof(*eh));
- if (m == NULL) {
- NG_FREE_ITEM(item);
- return(EINVAL);
- }
+ if ((m = m_pullup(m, sizeof(*eh))) == NULL) {
+ NG_FREE_ITEM(item);
+ return(EINVAL);
}
eh = mtod(m, struct ether_header *);
diff --git a/sys/netgraph/ng_frame_relay.c b/sys/netgraph/ng_frame_relay.c
--- a/sys/netgraph/ng_frame_relay.c
+++ b/sys/netgraph/ng_frame_relay.c
@@ -415,7 +415,7 @@
struct mbuf *m;
NGI_GET_M(item, m);
- if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL)
+ if ((m = m_pullup(m, 4)) == NULL)
ERROUT(ENOBUFS);
data = mtod(m, char *);
if ((alen = sc->addrlen) == 0) {
diff --git a/sys/netgraph/ng_gif.c b/sys/netgraph/ng_gif.c
--- a/sys/netgraph/ng_gif.c
+++ b/sys/netgraph/ng_gif.c
@@ -463,10 +463,8 @@
NG_FREE_M(m);
return (EINVAL);
}
- if (m->m_len < sizeof(sa_family_t)
- && (m = m_pullup(m, sizeof(sa_family_t))) == NULL) {
+ if ((m = m_pullup(m, sizeof(sa_family_t))) == NULL)
return (ENOBUFS);
- }
dst.sa_family = *mtod(m, sa_family_t *);
m_adj(m, sizeof(sa_family_t));
diff --git a/sys/netgraph/ng_gif_demux.c b/sys/netgraph/ng_gif_demux.c
--- a/sys/netgraph/ng_gif_demux.c
+++ b/sys/netgraph/ng_gif_demux.c
@@ -323,8 +323,7 @@
NG_FREE_ITEM(item);
return (EINVAL);
}
- if (m->m_len < sizeof(sa_family_t)
- && (m = m_pullup(m, sizeof(sa_family_t))) == NULL) {
+ if ((m = m_pullup(m, sizeof(sa_family_t))) == NULL) {
NG_FREE_ITEM(item);
return (ENOBUFS);
}
diff --git a/sys/netgraph/ng_ipfw.c b/sys/netgraph/ng_ipfw.c
--- a/sys/netgraph/ng_ipfw.c
+++ b/sys/netgraph/ng_ipfw.c
@@ -258,8 +258,7 @@
return (EINVAL); /* XXX: find smth better */
}
- if (m->m_len < sizeof(struct ip) &&
- (m = m_pullup(m, sizeof(struct ip))) == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL)
return (ENOBUFS);
ip = mtod(m, struct ip *);
@@ -340,8 +339,7 @@
if ((m = m_dup(*m0, M_NOWAIT)) == NULL)
return (ENOMEM); /* which is ignored */
- if (m->m_len < sizeof(struct ip) &&
- (m = m_pullup(m, sizeof(struct ip))) == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL)
return (EINVAL);
NG_SEND_DATA_ONLY(error, hook, m);
diff --git a/sys/netgraph/ng_l2tp.c b/sys/netgraph/ng_l2tp.c
--- a/sys/netgraph/ng_l2tp.c
+++ b/sys/netgraph/ng_l2tp.c
@@ -784,7 +784,7 @@
NG_FREE_M(m);
ERROUT(EINVAL);
}
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
+ if ((m = m_pullup(m, 2)) == NULL) {
priv->stats.memoryFailures++;
NG_FREE_ITEM(item);
ERROUT(EINVAL);
@@ -813,7 +813,7 @@
/* Get and validate length field if present */
if ((hdr & L2TP_HDR_LEN) != 0) {
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
+ if ((m = m_pullup(m, 2)) == NULL) {
priv->stats.memoryFailures++;
NG_FREE_ITEM(item);
ERROUT(EINVAL);
@@ -831,7 +831,7 @@
}
/* Get tunnel ID and session ID */
- if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
+ if ((m = m_pullup(m, 4)) == NULL) {
priv->stats.memoryFailures++;
NG_FREE_ITEM(item);
ERROUT(EINVAL);
@@ -863,7 +863,7 @@
/* Get Ns, Nr fields if present */
if ((hdr & L2TP_HDR_SEQ) != 0) {
- if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
+ if ((m = m_pullup(m, 4)) == NULL) {
priv->stats.memoryFailures++;
NG_FREE_ITEM(item);
ERROUT(EINVAL);
@@ -879,7 +879,7 @@
u_int16_t offset;
/* Get length of offset padding */
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
+ if ((m = m_pullup(m, 2)) == NULL) {
priv->stats.memoryFailures++;
NG_FREE_ITEM(item);
ERROUT(EINVAL);
@@ -1516,7 +1516,7 @@
priv->stats.xmitZLBs++;
} else {
/* Strip off session ID */
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL) {
+ if ((m = m_pullup(m, 2)) == NULL) {
priv->stats.memoryFailures++;
return (ENOBUFS);
}
diff --git a/sys/netgraph/ng_lmi.c b/sys/netgraph/ng_lmi.c
--- a/sys/netgraph/ng_lmi.c
+++ b/sys/netgraph/ng_lmi.c
@@ -569,7 +569,7 @@
log(LOG_WARNING, "nglmi: packetlen (%d) too big\n", packetlen);
goto drop;
}
- if (m->m_len < packetlen && (m = m_pullup(m, packetlen)) == NULL) {
+ if ((m = m_pullup(m, packetlen)) == NULL) {
log(LOG_WARNING,
"nglmi: m_pullup failed for %d bytes\n", packetlen);
return (0);
diff --git a/sys/netgraph/ng_patch.c b/sys/netgraph/ng_patch.c
--- a/sys/netgraph/ng_patch.c
+++ b/sys/netgraph/ng_patch.c
@@ -559,14 +559,13 @@
NGI_GET_M(item, m);
#define PULLUP_CHECK(mbuf, length) do { \
- pullup_len += length; \
+ pullup_len += (length); \
if (((mbuf)->m_pkthdr.len < pullup_len) || \
(pullup_len > MHLEN)) { \
error = EINVAL; \
goto bypass; \
} \
- if ((mbuf)->m_len < pullup_len && \
- (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL)) { \
+ if (((mbuf) = m_pullup((mbuf), pullup_len)) == NULL) { \
error = ENOBUFS; \
goto drop; \
} \
diff --git a/sys/netgraph/ng_ppp.c b/sys/netgraph/ng_ppp.c
--- a/sys/netgraph/ng_ppp.c
+++ b/sys/netgraph/ng_ppp.c
@@ -869,7 +869,7 @@
NG_FREE_ITEM(item);
return (EINVAL);
}
- if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL) {
+ if ((m = m_pullup(m, 4)) == NULL) {
NG_FREE_ITEM(item);
return (ENOBUFS);
}
@@ -1423,7 +1423,7 @@
link->stats.recvOctets += m->m_pkthdr.len;
/* Strip address and control fields, if present. */
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL)
+ if ((m = m_pullup(m, 2)) == NULL)
ERROUT(ENOBUFS);
if (mtod(m, uint8_t *)[0] == 0xff &&
mtod(m, uint8_t *)[1] == 0x03)
@@ -1554,7 +1554,7 @@
NG_FREE_M(m);
ERROUT(EINVAL);
}
- if (m->m_len < 2 && (m = m_pullup(m, 2)) == NULL)
+ if ((m = m_pullup(m, 2)) == NULL)
ERROUT(ENOBUFS);
shdr = be16dec(mtod(m, void *));
@@ -1571,7 +1571,7 @@
NG_FREE_M(m);
ERROUT(EINVAL);
}
- if (m->m_len < 4 && (m = m_pullup(m, 4)) == NULL)
+ if ((m = m_pullup(m, 4)) == NULL)
ERROUT(ENOBUFS);
lhdr = be32dec(mtod(m, void *));
@@ -2432,14 +2432,14 @@
{
*proto = 0;
- if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL)
+ if ((m = m_pullup(m, 1)) == NULL)
return (NULL);
*proto = *mtod(m, uint8_t *);
m_adj(m, 1);
if (!PROT_VALID(*proto)) {
- if (m->m_len < 1 && (m = m_pullup(m, 1)) == NULL)
+ if ((m = m_pullup(m, 1)) == NULL)
return (NULL);
*proto = (*proto << 8) + *mtod(m, uint8_t *);
@@ -2456,7 +2456,7 @@
ng_ppp_prepend(struct mbuf *m, const void *buf, int len)
{
M_PREPEND(m, len, M_NOWAIT);
- if (m == NULL || (m->m_len < len && (m = m_pullup(m, len)) == NULL))
+ if (m == NULL || ((m = m_pullup(m, len)) == NULL))
return (NULL);
bcopy(buf, mtod(m, uint8_t *), len);
return (m);
diff --git a/sys/netgraph/ng_pppoe.c b/sys/netgraph/ng_pppoe.c
--- a/sys/netgraph/ng_pppoe.c
+++ b/sys/netgraph/ng_pppoe.c
@@ -1446,7 +1446,7 @@
* generic PPP. PPPoE is an exception to the rule.
*/
if (m->m_pkthdr.len >= 2) {
- if (m->m_len < 2 && !(m = m_pullup(m, 2)))
+ if ((m = m_pullup(m, 2)) == NULL)
LEAVE(ENOBUFS);
if (mtod(m, u_char *)[0] == 0xff &&
mtod(m, u_char *)[1] == 0x03)
@@ -1454,7 +1454,7 @@
}
if (V_ng_pppoe_lcp_pcp && m->m_pkthdr.len >= 2 &&
- m->m_len >= 2 && (m = m_pullup(m, 2)) &&
+ (m = m_pullup(m, 2)) != NULL &&
mtod(m, uint16_t *)[0] == htons(PROT_LCP))
EVL_APPLY_PRI(m, (uint8_t)(V_ng_pppoe_lcp_pcp & 0x7));
@@ -1489,11 +1489,8 @@
* that has set up this hook. This indicates that it
* wants us to offer service.
*/
- if (m->m_len < sizeof(*wh)) {
- m = m_pullup(m, sizeof(*wh));
- if (m == NULL)
- LEAVE(ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(*wh))) == NULL)
+ LEAVE(ENOBUFS);
wh = mtod(m, struct pppoe_full_hdr *);
ph = &wh->ph;
code = wh->ph.code;
@@ -1598,13 +1595,10 @@
* Use them to decide where to send it.
*/
privp->packets_in++;
- if( m->m_len < sizeof(*wh)) {
- m = m_pullup(m, sizeof(*wh)); /* Checks length */
- if (m == NULL) {
- log(LOG_NOTICE, "ng_pppoe[%x]: couldn't "
- "m_pullup(wh)\n", node->nd_ID);
- LEAVE(ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(*wh))) == NULL) {
+ log(LOG_NOTICE, "ng_pppoe[%x]: couldn't m_pullup(wh)\n",
+ node->nd_ID);
+ LEAVE(ENOBUFS);
}
wh = mtod(m, struct pppoe_full_hdr *);
length = ntohs(wh->ph.length);
@@ -1618,14 +1612,10 @@
* (Linux wouldn't have this problem).
*/
if (m->m_pkthdr.len <= MHLEN) {
- if( m->m_len < m->m_pkthdr.len) {
- m = m_pullup(m, m->m_pkthdr.len);
- if (m == NULL) {
- log(LOG_NOTICE, "ng_pppoe[%x]: "
- "couldn't m_pullup(pkthdr)\n",
- node->nd_ID);
- LEAVE(ENOBUFS);
- }
+ if ((m = m_pullup(m, m->m_pkthdr.len)) == NULL) {
+ log(LOG_NOTICE, "ng_pppoe[%x]: couldn't "
+ "m_pullup(pkthdr)\n", node->nd_ID);
+ LEAVE(ENOBUFS);
}
}
if (m->m_len != m->m_pkthdr.len) {
diff --git a/sys/netgraph/ng_pptpgre.c b/sys/netgraph/ng_pptpgre.c
--- a/sys/netgraph/ng_pptpgre.c
+++ b/sys/netgraph/ng_pptpgre.c
@@ -660,8 +660,7 @@
m->m_pkthdr.rcvif = NULL;
} else {
M_PREPEND(m, grelen, M_NOWAIT);
- if (m == NULL || (m->m_len < grelen
- && (m = m_pullup(m, grelen)) == NULL)) {
+ if (m == NULL || (m = m_pullup(m, grelen)) == NULL) {
priv->stats.memoryFailures++;
ERROUT(ENOBUFS);
}
@@ -776,41 +775,35 @@
}
/* Safely pull up the complete IP+GRE headers */
- if (m->m_len < sizeof(*ip) + sizeof(*gre)) {
- if ((m = m_pullup(m, sizeof(*ip) + sizeof(*gre))) == NULL) {
- priv->stats.memoryFailures++;
- _NGI_M(item) = NULL;
- ERROUT(ENOBUFS);
- }
- _NGI_M(item) = m;
+ if ((m = m_pullup(m, sizeof(*ip) + sizeof(*gre))) == NULL) {
+ priv->stats.memoryFailures++;
+ _NGI_M(item) = NULL;
+ ERROUT(ENOBUFS);
}
+ _NGI_M(item) = m;
ip = mtod(m, const struct ip *);
iphlen = ip->ip_hl << 2;
- if (m->m_len < iphlen + sizeof(*gre)) {
- if ((m = m_pullup(m, iphlen + sizeof(*gre))) == NULL) {
- priv->stats.memoryFailures++;
- _NGI_M(item) = NULL;
- ERROUT(ENOBUFS);
- }
- _NGI_M(item) = m;
- ip = mtod(m, const struct ip *);
+ if ((m = m_pullup(m, iphlen + sizeof(*gre))) == NULL) {
+ priv->stats.memoryFailures++;
+ _NGI_M(item) = NULL;
+ ERROUT(ENOBUFS);
}
+ _NGI_M(item) = m;
+ ip = mtod(m, const struct ip *);
gre = (const struct greheader *)((const u_char *)ip + iphlen);
grelen = sizeof(*gre) + sizeof(u_int32_t) * (gre->hasSeq + gre->hasAck);
if (m->m_pkthdr.len < iphlen + grelen) {
priv->stats.recvRunts++;
ERROUT(EINVAL);
}
- if (m->m_len < iphlen + grelen) {
- if ((m = m_pullup(m, iphlen + grelen)) == NULL) {
- priv->stats.memoryFailures++;
- _NGI_M(item) = NULL;
- ERROUT(ENOBUFS);
- }
- _NGI_M(item) = m;
- ip = mtod(m, const struct ip *);
- gre = (const struct greheader *)((const u_char *)ip + iphlen);
+ if ((m = m_pullup(m, iphlen + grelen)) == NULL) {
+ priv->stats.memoryFailures++;
+ _NGI_M(item) = NULL;
+ ERROUT(ENOBUFS);
}
+ _NGI_M(item) = m;
+ ip = mtod(m, const struct ip *);
+ gre = (const struct greheader *)((const u_char *)ip + iphlen);
/* Sanity check packet length and GRE header bits */
extralen = m->m_pkthdr.len
diff --git a/sys/netgraph/ng_rfc1490.c b/sys/netgraph/ng_rfc1490.c
--- a/sys/netgraph/ng_rfc1490.c
+++ b/sys/netgraph/ng_rfc1490.c
@@ -313,8 +313,7 @@
const u_char *start;
const u_char *ptr;
- if (m->m_len < MAX_ENCAPS_HDR
- && !(m = m_pullup(m, MAX_ENCAPS_HDR)))
+ if ((m = m_pullup(m, MAX_ENCAPS_HDR)) == NULL)
ERROUT(ENOBUFS);
ptr = start = mtod(m, const u_char *);
diff --git a/sys/netgraph/ng_tcpmss.c b/sys/netgraph/ng_tcpmss.c
--- a/sys/netgraph/ng_tcpmss.c
+++ b/sys/netgraph/ng_tcpmss.c
@@ -294,11 +294,10 @@
goto send;
#define M_CHECK(length) do { \
- pullup_len += length; \
- if ((m)->m_pkthdr.len < pullup_len) \
+ pullup_len += (length); \
+ if (m->m_pkthdr.len < pullup_len) \
goto send; \
- if ((m)->m_len < pullup_len && \
- (((m) = m_pullup((m), pullup_len)) == NULL)) \
+ if ((m = m_pullup(m, pullup_len)) == NULL) \
ERROUT(ENOBUFS); \
} while (0)
diff --git a/sys/netgraph/ng_vjc.c b/sys/netgraph/ng_vjc.c
--- a/sys/netgraph/ng_vjc.c
+++ b/sys/netgraph/ng_vjc.c
@@ -453,8 +453,7 @@
need2pullup = MAX_VJHEADER;
if (need2pullup > m->m_pkthdr.len)
need2pullup = m->m_pkthdr.len;
- if (m->m_len < need2pullup
- && (m = m_pullup(m, need2pullup)) == NULL) {
+ if ((m = m_pullup(m, need2pullup)) == NULL) {
priv->slc.sls_errorin++;
NG_FREE_ITEM(item);
return (ENOBUFS);
@@ -592,20 +591,17 @@
struct tcphdr *tcp;
int ihlen, thlen;
- if (m->m_len < sizeof(*ip) && (m = m_pullup(m, sizeof(*ip))) == NULL)
+ if ((m = m_pullup(m, sizeof(*ip))) == NULL)
return (NULL);
ip = mtod(m, struct ip *);
if (!knownTCP && ip->ip_p != IPPROTO_TCP)
return (m);
ihlen = ip->ip_hl << 2;
- if (m->m_len < ihlen + sizeof(*tcp)) {
- if ((m = m_pullup(m, ihlen + sizeof(*tcp))) == NULL)
- return (NULL);
- ip = mtod(m, struct ip *);
- }
+ if ((m = m_pullup(m, ihlen + sizeof(*tcp))) == NULL)
+ return (NULL);
+ ip = mtod(m, struct ip *);
tcp = (struct tcphdr *)((u_char *)ip + ihlen);
thlen = tcp->th_off << 2;
- if (m->m_len < ihlen + thlen)
- m = m_pullup(m, ihlen + thlen);
- return (m);
+
+ return (m_pullup(m, ihlen + thlen));
}
diff --git a/sys/netgraph/ng_vlan.c b/sys/netgraph/ng_vlan.c
--- a/sys/netgraph/ng_vlan.c
+++ b/sys/netgraph/ng_vlan.c
@@ -205,7 +205,7 @@
(*mp) = NULL;
return (EINVAL);
}
- if ((*mp)->m_len < len && ((*mp) = m_pullup((*mp), len)) == NULL)
+ if ((*mp = m_pullup(*mp, len)) == NULL)
return (ENOBUFS);
return (0);
diff --git a/sys/netgraph/ng_vlan_rotate.c b/sys/netgraph/ng_vlan_rotate.c
--- a/sys/netgraph/ng_vlan_rotate.c
+++ b/sys/netgraph/ng_vlan_rotate.c
@@ -401,12 +401,9 @@
size_t expected_len = sizeof(struct ether_vlan_stack_header)
+ vlans * sizeof(struct ether_vlan_stack_entry);
- if (m->m_len < expected_len) {
- m = m_pullup(m, expected_len);
- if (m == NULL) {
- error = EINVAL;
- goto fail;
- }
+ if ((m = m_pullup(m, expected_len)) == NULL) {
+ error = EINVAL;
+ goto fail;
}
evsh = mtod(m, struct ether_vlan_stack_header *);
diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -657,8 +657,7 @@
ifp = m->m_pkthdr.rcvif;
- if (m->m_len < sizeof(struct arphdr) &&
- ((m = m_pullup(m, sizeof(struct arphdr))) == NULL)) {
+ if ((m = m_pullup(m, sizeof(struct arphdr))) == NULL) {
ARP_LOG(LOG_NOTICE, "packet with short header received on %s\n",
if_name(ifp));
return;
@@ -666,15 +665,12 @@
ar = mtod(m, struct arphdr *);
/* Check if length is sufficient */
- if (m->m_len < arphdr_len(ar)) {
- m = m_pullup(m, arphdr_len(ar));
- if (m == NULL) {
- ARP_LOG(LOG_NOTICE, "short packet received on %s\n",
- if_name(ifp));
- return;
- }
- ar = mtod(m, struct arphdr *);
+ if ((m = m_pullup(m, arphdr_len(ar))) == NULL) {
+ ARP_LOG(LOG_NOTICE, "short packet received on %s\n",
+ if_name(ifp));
+ return;
}
+ ar = mtod(m, struct arphdr *);
hlen = 0;
layer = "";
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -533,12 +533,10 @@
return (IPPROTO_DONE);
}
- if (m->m_len < iplen + sizeof(*vh)) {
- if ((m = m_pullup(m, iplen + sizeof(*vh))) == NULL) {
- CARPSTATS_INC(carps_hdrops);
- CARP_DEBUG("%s():%d: pullup failed\n", __func__, __LINE__);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, iplen + sizeof(*vh))) == NULL) {
+ CARPSTATS_INC(carps_hdrops);
+ CARP_DEBUG("%s():%d: pullup failed\n", __func__, __LINE__);
+ return (IPPROTO_DONE);
}
ip = mtod(m, struct ip *);
totlen = ntohs(ip->ip_len);
@@ -570,15 +568,13 @@
return (IPPROTO_DONE);
}
- if (m->m_len < iplen + minlen) {
- if ((m = m_pullup(m, iplen + minlen)) == NULL) {
- CARPSTATS_INC(carps_hdrops);
- CARP_DEBUG("%s():%d: pullup failed\n", __func__, __LINE__);
- return (IPPROTO_DONE);
- }
- ip = mtod(m, struct ip *);
- vh = (struct vrrpv3_header *)((char *)ip + iplen);
+ if ((m = m_pullup(m, iplen + minlen)) == NULL) {
+ CARPSTATS_INC(carps_hdrops);
+ CARP_DEBUG("%s():%d: pullup failed\n", __func__, __LINE__);
+ return (IPPROTO_DONE);
}
+ ip = mtod(m, struct ip *);
+ vh = (struct vrrpv3_header *)((char *)ip + iplen);
switch (vh->vrrp_version) {
case CARP_VERSION_CARP: {
@@ -620,7 +616,7 @@
struct mbuf *m = *mp;
struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
struct vrrpv3_header *vh;
- u_int len, minlen;
+ u_int minlen;
CARPSTATS_INC(carps_ipackets6);
@@ -638,16 +634,11 @@
return (IPPROTO_DONE);
}
- if (m->m_len < *offp + sizeof(*vh)) {
- len = m->m_len;
- m = m_pullup(m, *offp + sizeof(*vh));
- if (m == NULL) {
- CARPSTATS_INC(carps_badlen);
- CARP_DEBUG("%s: packet size %u too small\n", __func__, len);
- return (IPPROTO_DONE);
- }
- ip6 = mtod(m, struct ip6_hdr *);
+ if ((m = m_pullup(m, *offp + sizeof(*vh))) == NULL) {
+ CARPSTATS_INC(carps_badlen);
+ return (IPPROTO_DONE);
}
+ ip6 = mtod(m, struct ip6_hdr *);
vh = (struct vrrpv3_header *)(mtod(m, char *) + *offp);
switch (vh->vrrp_version) {
@@ -676,15 +667,12 @@
return (IPPROTO_DONE);
}
- if (m->m_len < sizeof(*ip6) + minlen) {
- if ((m = m_pullup(m, sizeof(*ip6) + minlen)) == NULL) {
- CARPSTATS_INC(carps_hdrops);
- CARP_DEBUG("%s():%d: pullup failed\n", __func__, __LINE__);
- return (IPPROTO_DONE);
- }
- ip6 = mtod(m, struct ip6_hdr *);
- vh = (struct vrrpv3_header *)mtodo(m, sizeof(*ip6));
+ if ((m = m_pullup(m, sizeof(*ip6) + minlen)) == NULL) {
+ CARPSTATS_INC(carps_hdrops);
+ return (IPPROTO_DONE);
}
+ ip6 = mtod(m, struct ip6_hdr *);
+ vh = (struct vrrpv3_header *)mtodo(m, sizeof(*ip6));
switch (vh->vrrp_version) {
case CARP_VERSION_CARP: {
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -208,8 +208,7 @@
return;
}
/* Assure header */
- if (m->m_len < sizeof(struct ip) &&
- (m = m_pullup(m, sizeof(struct ip))) == NULL)
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL)
return;
#ifdef INET
/* Delayed checksums are currently not compatible with divert. */
@@ -355,8 +354,7 @@
m_freem(control);
/* Packet must have a header (but that's about it) */
- if (m->m_len < sizeof (struct ip) &&
- (m = m_pullup(m, sizeof (struct ip))) == NULL) {
+ if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
m_freem(m);
return (EINVAL);
}
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c
--- a/sys/netinet/ip_icmp.c
+++ b/sys/netinet/ip_icmp.c
@@ -263,8 +263,7 @@
if (oiphlen + sizeof(struct tcphdr) > n->m_len &&
n->m_next == NULL)
goto stdreply;
- if (n->m_len < oiphlen + sizeof(struct tcphdr) &&
- (n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL)
+ if ((n = m_pullup(n, oiphlen + sizeof(struct tcphdr))) == NULL)
goto freeit;
oip = mtod(n, struct ip *);
th = mtodo(n, oiphlen);
@@ -275,8 +274,7 @@
goto freeit;
if (oiphlen + tcphlen > n->m_len && n->m_next == NULL)
goto stdreply;
- if (n->m_len < oiphlen + tcphlen &&
- (n = m_pullup(n, oiphlen + tcphlen)) == NULL)
+ if ((n = m_pullup(n, oiphlen + tcphlen)) == NULL)
goto freeit;
oip = mtod(n, struct ip *);
icmpelen = max(tcphlen, min(V_icmp_quotelen,
@@ -290,8 +288,7 @@
if (oiphlen + sizeof(struct sctphdr) > n->m_len &&
n->m_next == NULL)
goto stdreply;
- if (n->m_len < oiphlen + sizeof(struct sctphdr) &&
- (n = m_pullup(n, oiphlen + sizeof(struct sctphdr))) == NULL)
+ if ((n = m_pullup(n, oiphlen + sizeof(struct sctphdr))) == NULL)
goto freeit;
oip = mtod(n, struct ip *);
icmpelen = max(sizeof(struct sctphdr),
@@ -302,9 +299,8 @@
sizeof(struct sctphdr) + 8 &&
(n->m_len >= oiphlen + sizeof(struct sctphdr) + 8 ||
n->m_next != NULL)) {
- if (n->m_len < oiphlen + sizeof(struct sctphdr) + 8 &&
- (n = m_pullup(n, oiphlen +
- sizeof(struct sctphdr) + 8)) == NULL)
+ if ((n = m_pullup(n, oiphlen + sizeof(struct sctphdr) +
+ 8)) == NULL)
goto freeit;
oip = mtod(n, struct ip *);
sh = mtodo(n, oiphlen);
@@ -487,7 +483,7 @@
goto freeit;
}
i = hlen + min(icmplen, ICMP_ADVLENMIN);
- if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
+ if ((m = m_pullup(m, i)) == NULL) {
ICMPSTAT_INC(icps_tooshort);
return (IPPROTO_DONE);
}
@@ -570,7 +566,7 @@
*/
i = sizeof(struct ip) + min(icmplen, ICMP_ADVLENPREF(icp));
ip_stripoptions(m);
- if (m->m_len < i && (m = m_pullup(m, i)) == NULL) {
+ if ((m = m_pullup(m, i)) == NULL) {
/* This should actually not happen */
ICMPSTAT_INC(icps_tooshort);
return (IPPROTO_DONE);
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -501,12 +501,9 @@
if (__predict_false(m->m_pkthdr.len < sizeof(struct ip)))
goto tooshort;
- if (m->m_len < sizeof(struct ip)) {
- m = m_pullup(m, sizeof(struct ip));
- if (__predict_false(m == NULL)) {
- IPSTAT_INC(ips_toosmall);
- return;
- }
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL) {
+ IPSTAT_INC(ips_toosmall);
+ return;
}
ip = mtod(m, struct ip *);
@@ -520,14 +517,11 @@
IPSTAT_INC(ips_badhlen);
goto bad;
}
- if (hlen > m->m_len) {
- m = m_pullup(m, hlen);
- if (__predict_false(m == NULL)) {
- IPSTAT_INC(ips_badhlen);
- return;
- }
- ip = mtod(m, struct ip *);
+ if ((m = m_pullup(m, hlen)) == NULL) {
+ IPSTAT_INC(ips_badhlen);
+ return;
}
+ ip = mtod(m, struct ip *);
IP_PROBE(receive, NULL, NULL, ip, m->m_pkthdr.rcvif, ip, NULL);
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c
--- a/sys/netinet/ip_mroute.c
+++ b/sys/netinet/ip_mroute.c
@@ -2621,7 +2621,7 @@
* Get the IP and PIM headers in contiguous memory, and
* possibly the PIM REGISTER header.
*/
- if (m->m_len < minlen && (m = m_pullup(m, minlen)) == NULL) {
+ if ((m = m_pullup(m, minlen)) == NULL) {
CTR1(KTR_IPMF, "%s: m_pullup() failed", __func__);
return (IPPROTO_DONE);
}
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -469,12 +469,9 @@
return (ENOMEM);
ip = mtod(m, struct ip *);
hlen = ip->ip_hl << 2;
- if (m->m_len < hlen) {
- m = m_pullup(m, hlen);
- if (m == NULL)
- return (EINVAL);
- ip = mtod(m, struct ip *);
- }
+ if ((m = m_pullup(m, hlen)) == NULL)
+ return (EINVAL);
+ ip = mtod(m, struct ip *);
if (V_fib_hash_outbound) {
uint32_t hash_type, hash_val;
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -569,19 +569,12 @@
int
tcp6_input_with_port(struct mbuf **mp, int *offp, int proto, uint16_t port)
{
- struct mbuf *m;
- m = *mp;
- if (m->m_len < *offp + sizeof(struct tcphdr)) {
- m = m_pullup(m, *offp + sizeof(struct tcphdr));
- if (m == NULL) {
- *mp = m;
- TCPSTAT_INC(tcps_rcvshort);
- return (IPPROTO_DONE);
- }
+ if ((*mp = m_pullup(*mp, *offp + sizeof(struct tcphdr))) == NULL) {
+ TCPSTAT_INC(tcps_rcvshort);
+ return (IPPROTO_DONE);
}
- *mp = m;
return (tcp_input_with_port(mp, offp, proto, port));
}
@@ -692,12 +685,9 @@
ip_stripoptions(m);
off0 = sizeof(struct ip);
}
- if (m->m_len < sizeof (struct tcpiphdr)) {
- if ((m = m_pullup(m, sizeof (struct tcpiphdr)))
- == NULL) {
- TCPSTAT_INC(tcps_rcvshort);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == NULL) {
+ TCPSTAT_INC(tcps_rcvshort);
+ return (IPPROTO_DONE);
}
ip = mtod(m, struct ip *);
th = (struct tcphdr *)((char *)ip + off0);
@@ -768,15 +758,12 @@
if (off > sizeof (struct tcphdr)) {
#ifdef INET6
if (isipv6) {
- if (m->m_len < off0 + off) {
- m = m_pullup(m, off0 + off);
- if (m == NULL) {
- TCPSTAT_INC(tcps_rcvshort);
- return (IPPROTO_DONE);
- }
- ip6 = mtod(m, struct ip6_hdr *);
- th = (struct tcphdr *)((char *)ip6 + off0);
+ if ((m = m_pullup(m, off0 + off)) == NULL) {
+ TCPSTAT_INC(tcps_rcvshort);
+ return (IPPROTO_DONE);
}
+ ip6 = mtod(m, struct ip6_hdr *);
+ th = (struct tcphdr *)((char *)ip6 + off0);
}
#endif
#if defined(INET) && defined(INET6)
@@ -784,15 +771,13 @@
#endif
#ifdef INET
{
- if (m->m_len < sizeof(struct ip) + off) {
- if ((m = m_pullup(m, sizeof (struct ip) + off))
- == NULL) {
- TCPSTAT_INC(tcps_rcvshort);
- return (IPPROTO_DONE);
- }
- ip = mtod(m, struct ip *);
- th = (struct tcphdr *)((char *)ip + off0);
+ if ((m = m_pullup(m, sizeof (struct ip) + off)) ==
+ NULL) {
+ TCPSTAT_INC(tcps_rcvshort);
+ return (IPPROTO_DONE);
}
+ ip = mtod(m, struct ip *);
+ th = (struct tcphdr *)((char *)ip + off0);
}
#endif
optlen = off - sizeof (struct tcphdr);
diff --git a/sys/netinet/tcp_stacks/rack_bbr_common.c b/sys/netinet/tcp_stacks/rack_bbr_common.c
--- a/sys/netinet/tcp_stacks/rack_bbr_common.c
+++ b/sys/netinet/tcp_stacks/rack_bbr_common.c
@@ -166,12 +166,10 @@
#ifdef INET6
case ETHERTYPE_IPV6:
{
- if (m->m_len < (sizeof(*ip6) + sizeof(*th))) {
- m = m_pullup(m, sizeof(*ip6) + sizeof(*th));
- if (m == NULL) {
- KMOD_TCPSTAT_INC(tcps_rcvshort);
- return (-1);
- }
+ if ((m = m_pullup(m, sizeof(*ip6) + sizeof(*th))) ==
+ NULL) {
+ KMOD_TCPSTAT_INC(tcps_rcvshort);
+ return (-1);
}
ip6 = mtod(m, struct ip6_hdr *);
th = (struct tcphdr *)(ip6 + 1);
@@ -198,12 +196,10 @@
#ifdef INET
case ETHERTYPE_IP:
{
- if (m->m_len < sizeof (struct tcpiphdr)) {
- m = m_pullup(m, sizeof (struct tcpiphdr));
- if (m == NULL) {
- KMOD_TCPSTAT_INC(tcps_rcvshort);
- return (-1);
- }
+ if ((m = m_pullup(m, sizeof (struct tcpiphdr))) ==
+ NULL) {
+ KMOD_TCPSTAT_INC(tcps_rcvshort);
+ return (-1);
}
ip = mtod(m, struct ip *);
th = (struct tcphdr *)(ip + 1);
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -578,7 +578,7 @@
#endif
struct udphdr *uh;
struct tcphdr *th;
- int len, thlen;
+ int len;
uint16_t port;
TCPSTAT_INC(tcps_tunneled_pkts);
@@ -588,27 +588,23 @@
m_freem(m);
return (true);
}
- thlen = sizeof(struct tcphdr);
- if (m->m_len < off + sizeof(struct udphdr) + thlen &&
- (m = m_pullup(m, off + sizeof(struct udphdr) + thlen)) == NULL) {
+ if ((m = m_pullup(m, off + sizeof(struct udphdr) +
+ sizeof(struct tcphdr))) == NULL) {
TCPSTAT_INC(tcps_tunneled_errs);
return (true);
}
iph = mtod(m, struct ip *);
uh = (struct udphdr *)((char *)iph + off);
th = (struct tcphdr *)(uh + 1);
- thlen = th->th_off << 2;
- if (m->m_len < off + sizeof(struct udphdr) + thlen) {
- m = m_pullup(m, off + sizeof(struct udphdr) + thlen);
- if (m == NULL) {
- TCPSTAT_INC(tcps_tunneled_errs);
- return (true);
- } else {
- iph = mtod(m, struct ip *);
- uh = (struct udphdr *)((char *)iph + off);
- th = (struct tcphdr *)(uh + 1);
- }
+ if ((m = m_pullup(m, off + sizeof(struct udphdr) +
+ (th->th_off << 2))) == NULL) {
+ TCPSTAT_INC(tcps_tunneled_errs);
+ return (true);
}
+ iph = mtod(m, struct ip *);
+ uh = (struct udphdr *)((char *)iph + off);
+ th = (struct tcphdr *)(uh + 1);
+
m->m_pkthdr.tcp_tun_port = port = uh->uh_sport;
bcopy(th, uh, m->m_len - off - sizeof(struct udphdr));
m->m_len -= sizeof(struct udphdr);
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -496,11 +496,9 @@
/*
* Get IP and UDP header together in first mbuf.
*/
- if (m->m_len < iphlen + sizeof(struct udphdr)) {
- if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == NULL) {
- UDPSTAT_INC(udps_hdrops);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, iphlen + sizeof(struct udphdr))) == NULL) {
+ UDPSTAT_INC(udps_hdrops);
+ return (IPPROTO_DONE);
}
ip = mtod(m, struct ip *);
uh = (struct udphdr *)((char *)ip + iphlen);
diff --git a/sys/netinet6/dest6.c b/sys/netinet6/dest6.c
--- a/sys/netinet6/dest6.c
+++ b/sys/netinet6/dest6.c
@@ -67,27 +67,20 @@
u_int8_t *opt;
m = *mp;
+ *mp = NULL; /* Consumed in most cases. */
off = *offp;
/* Validation of the length of the header. */
- if (m->m_len < off + sizeof(*dstopts)) {
- m = m_pullup(m, off + sizeof(*dstopts));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + sizeof(*dstopts))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
dstopts = (struct ip6_dest *)(mtod(m, char *) + off);
dstoptlen = (dstopts->ip6d_len + 1) << 3;
- if (m->m_len < off + dstoptlen) {
- m = m_pullup(m, off + dstoptlen);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + dstoptlen)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
dstopts = (struct ip6_dest *)(mtod(m, char *) + off);
off += dstoptlen;
@@ -112,10 +105,8 @@
default: /* unknown option */
optlen = ip6_unknown_opt(opt, m,
opt - mtod(m, u_int8_t *));
- if (optlen == -1) {
- *mp = NULL;
+ if (optlen == -1)
return (IPPROTO_DONE);
- }
optlen += 2;
break;
}
@@ -127,6 +118,5 @@
bad:
m_freem(m);
- *mp = NULL;
return (IPPROTO_DONE);
}
diff --git a/sys/netinet6/frag6.c b/sys/netinet6/frag6.c
--- a/sys/netinet6/frag6.c
+++ b/sys/netinet6/frag6.c
@@ -440,17 +440,14 @@
#endif
m = *mp;
+ *mp = NULL; /* Consumed in most cases. */
offset = *offp;
M_ASSERTPKTHDR(m);
- if (m->m_len < offset + sizeof(struct ip6_frag)) {
- m = m_pullup(m, offset + sizeof(struct ip6_frag));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, offset + sizeof(struct ip6_frag))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
@@ -464,7 +461,6 @@
if (ip6->ip6_plen == 0) {
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER, offset);
in6_ifstat_inc(dstifp, ifs6_reass_fail);
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -480,7 +476,6 @@
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
offsetof(struct ip6_hdr, ip6_plen));
in6_ifstat_inc(dstifp, ifs6_reass_fail);
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -524,7 +519,6 @@
offsetof(struct ip6_hdr, ip6_plen));
in6_ifstat_inc(dstifp, ifs6_reass_fail);
IP6STAT_INC(ip6s_fragdropped);
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -650,7 +644,6 @@
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
offset - sizeof(struct ip6_frag) +
offsetof(struct ip6_frag, ip6f_offlg));
- *mp = NULL;
return (IPPROTO_DONE);
}
} else if (fragoff + frgpartlen > IPV6_MAXPACKET) {
@@ -660,7 +653,6 @@
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
offset - sizeof(struct ip6_frag) +
offsetof(struct ip6_frag, ip6f_offlg));
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -809,7 +801,6 @@
frag6_freef(q6, bucket);
}
IP6QB_UNLOCK(bucket);
- *mp = NULL;
return (IPPROTO_DONE);
}
plen += af6->ip6af_frglen;
@@ -821,7 +812,6 @@
frag6_freef(q6, bucket);
}
IP6QB_UNLOCK(bucket);
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -902,7 +892,6 @@
#ifdef RSS
/* Queue/dispatch for reprocessing. */
netisr_dispatch(NETISR_IPV6_DIRECT, m);
- *mp = NULL;
return (IPPROTO_DONE);
#endif
@@ -918,7 +907,6 @@
in6_ifstat_inc(dstifp, ifs6_reass_fail);
IP6STAT_INC(ip6s_fragdropped);
m_freem(m);
- *mp = NULL;
return (IPPROTO_DONE);
}
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -243,12 +243,9 @@
if (ifp == NULL)
return;
- if (m->m_len < sizeof(struct ip6_hdr)) {
- m = m_pullup(m, sizeof(struct ip6_hdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
ip6 = mtod(m, struct ip6_hdr *);
@@ -285,12 +282,9 @@
}
#endif
- if (m->m_len < sizeof(struct ip6_hdr)) {
- m = m_pullup(m, sizeof(struct ip6_hdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
oip6 = mtod(m, struct ip6_hdr *);
@@ -329,12 +323,9 @@
if (off >= 0 && nxt == IPPROTO_ICMPV6) {
struct icmp6_hdr *icp;
- if (m->m_len < off + sizeof(struct icmp6_hdr)) {
- m = m_pullup(m, off + sizeof(struct icmp6_hdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, off + sizeof(struct icmp6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
oip6 = mtod(m, struct ip6_hdr *);
icp = (struct icmp6_hdr *)(mtod(m, char *) + off);
@@ -459,15 +450,12 @@
NET_EPOCH_ASSERT();
m = *mp;
+ *mp = NULL; /* Always consumed. */
off = *offp;
- if (m->m_len < off + sizeof(struct icmp6_hdr)) {
- m = m_pullup(m, off + sizeof(struct icmp6_hdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + sizeof(struct icmp6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
/*
@@ -601,12 +589,9 @@
n->m_pkthdr.len = n0len + (noff - off);
n->m_next = n0;
} else {
- if (n->m_len < off + sizeof(*nicmp6)) {
- n = m_pullup(n, off + sizeof(*nicmp6));
- if (n == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- break;
- }
+ if ((n = m_pullup(n, off + sizeof(*nicmp6))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ break;
}
nicmp6 = (struct icmp6_hdr *)(mtod(n, char *) + off);
noff = off;
@@ -641,10 +626,8 @@
*/
if ((ip6->ip6_hlim != 1) || (m->m_flags & M_RTALERT_MLD) == 0)
goto freeit;
- if (mld_input(&m, off, icmp6len) != 0) {
- *mp = NULL;
+ if (mld_input(&m, off, icmp6len) != 0)
return (IPPROTO_DONE);
- }
/* m stays. */
break;
@@ -672,14 +655,10 @@
if (pr == NULL)
pr = curthread->td_ucred->cr_prison;
if (mode == FQDN) {
- if (m->m_len < off + sizeof(struct icmp6_nodeinfo)) {
- m = m_pullup(m, off +
- sizeof(struct icmp6_nodeinfo));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off +
+ sizeof(struct icmp6_nodeinfo))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
n = m_copym(m, 0, M_COPYALL, M_NOWAIT);
if (n)
@@ -765,13 +744,9 @@
if (icmp6len < sizeof(struct nd_router_solicit))
goto badlen;
if (send_sendso_input_hook != NULL) {
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
error = send_sendso_input_hook(m, ifp, SND_IN, ip6len);
if (error == 0) {
@@ -890,7 +865,6 @@
deliver:
if (icmp6_notify_error(&m, off, icmp6len) != 0) {
/* In this case, m should've been freed. */
- *mp = NULL;
return (IPPROTO_DONE);
}
break;
@@ -907,12 +881,10 @@
/* deliver the packet to appropriate sockets */
icmp6_rip6_input(&m, *offp);
- *mp = m;
return (IPPROTO_DONE);
freeit:
m_freem(m);
- *mp = NULL;
return (IPPROTO_DONE);
}
@@ -926,19 +898,17 @@
struct sockaddr_in6 icmp6src, icmp6dst;
m = *mp;
+ *mp = NULL; /* Consumed in most cases. */
if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
ICMP6STAT_INC(icp6s_tooshort);
goto freeit;
}
- if (m->m_len < off + sizeof(*icmp6) + sizeof(struct ip6_hdr)) {
- m = m_pullup(m, off + sizeof(*icmp6) + sizeof(struct ip6_hdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (-1);
- }
+ if ((m = m_pullup(m, off + sizeof(*icmp6) + sizeof(struct ip6_hdr))) ==
+ NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
icmp6 = (struct icmp6_hdr *)(mtod(m, char *) + off);
eip6 = (struct ip6_hdr *)(icmp6 + 1);
@@ -963,14 +933,10 @@
case IPPROTO_HOPOPTS:
case IPPROTO_DSTOPTS:
case IPPROTO_AH:
- if (m->m_len < eoff + sizeof(struct ip6_ext)) {
- m = m_pullup(m, eoff +
- sizeof(struct ip6_ext));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (-1);
- }
+ if ((m = m_pullup(m, eoff +
+ sizeof(struct ip6_ext))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
eh = (struct ip6_ext *)
(mtod(m, char *) + eoff);
@@ -989,13 +955,10 @@
* information that depends on the final
* destination (e.g. path MTU).
*/
- if (m->m_len < eoff + sizeof(*rth)) {
- m = m_pullup(m, eoff + sizeof(*rth));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (-1);
- }
+ if ((m = m_pullup(m, eoff + sizeof(*rth))) ==
+ NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
rth = (struct ip6_rthdr *)
(mtod(m, char *) + eoff);
@@ -1012,14 +975,10 @@
rth->ip6r_type == IPV6_RTHDR_TYPE_0) {
int hops;
- if (m->m_len < eoff + rthlen) {
- m = m_pullup(m, eoff + rthlen);
- if (m == NULL) {
- IP6STAT_INC(
- ip6s_exthdrtoolong);
- *mp = m;
- return (-1);
- }
+ if ((m = m_pullup(m, eoff + rthlen)) ==
+ NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
rth0 = (struct ip6_rthdr0 *)
(mtod(m, char *) + eoff);
@@ -1033,14 +992,10 @@
nxt = rth->ip6r_nxt;
break;
case IPPROTO_FRAGMENT:
- if (m->m_len < eoff + sizeof(struct ip6_frag)) {
- m = m_pullup(m, eoff +
- sizeof(struct ip6_frag));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = m;
- return (-1);
- }
+ if ((m = m_pullup(m, eoff +
+ sizeof(struct ip6_frag))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
fh = (struct ip6_frag *)(mtod(m, char *) +
eoff);
@@ -1126,7 +1081,6 @@
freeit:
m_freem(m);
- *mp = NULL;
return (-1);
}
@@ -1322,14 +1276,10 @@
mtx_unlock(&pr->pr_mtx);
if (!n || n->m_next || n->m_len == 0)
goto bad;
- if (m->m_len < off + sizeof(struct icmp6_nodeinfo) +
- subjlen) {
- m = m_pullup(m, off +
- sizeof(struct icmp6_nodeinfo) + subjlen);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- goto bad;
- }
+ if ((m = m_pullup(m, off +
+ sizeof(struct icmp6_nodeinfo) + subjlen)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ goto bad;
}
/* ip6 possibly invalid but not used after. */
ni6 = (struct icmp6_nodeinfo *)(mtod(m, char *) + off);
@@ -2036,18 +1986,14 @@
m_copydata(m, 0, sizeof(nip6), &nip6);
m_adj(m, l);
l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
- if (m->m_len < l) {
- if ((m = m_pullup(m, l)) == NULL)
- return;
- }
+ if ((m = m_pullup(m, l)) == NULL)
+ return;
bcopy(&nip6, mtod(m, void *), sizeof(nip6));
} else /* off == sizeof(struct ip6_hdr) */ {
size_t l;
l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
- if (m->m_len < l) {
- if ((m = m_pullup(m, l)) == NULL)
- return;
- }
+ if ((m = m_pullup(m, l)) == NULL)
+ return;
}
plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
ip6 = mtod(m, struct ip6_hdr *);
@@ -2187,12 +2133,9 @@
ip6 = mtod(m, struct ip6_hdr *);
icmp6len = ntohs(ip6->ip6_plen);
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
ip6 = mtod(m, struct ip6_hdr *);
nd_rd = (struct nd_redirect *)((char *)ip6 + off);
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -597,12 +597,10 @@
m_freem(m);
m = n;
}
- if (m->m_len < sizeof(struct ip6_hdr)) {
- if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
- IP6STAT_INC(ip6s_toosmall);
- in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
- goto bad;
- }
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+ IP6STAT_INC(ip6s_toosmall);
+ in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
+ goto bad;
}
ip6 = mtod(m, struct ip6_hdr *);
@@ -946,41 +944,31 @@
static int
ip6_hopopts_input(u_int32_t *rtalertp, struct mbuf **mp, int *offp)
{
- struct mbuf *m = *mp;
int off = *offp, hbhlen;
struct ip6_hbh *hbh;
/* validation of the length of the header */
- if (m->m_len < off + sizeof(*hbh)) {
- m = m_pullup(m, off + sizeof(*hbh));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (-1);
- }
+ if ((*mp = m_pullup(*mp, off + sizeof(*hbh))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
- hbh = (struct ip6_hbh *)(mtod(m, char *) + off);
+ hbh = (struct ip6_hbh *)(mtod(*mp, char *) + off);
hbhlen = (hbh->ip6h_len + 1) << 3;
- if (m->m_len < off + hbhlen) {
- m = m_pullup(m, off + hbhlen);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (-1);
- }
+ if ((*mp = m_pullup(*mp, off + hbhlen)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (-1);
}
- hbh = (struct ip6_hbh *)(mtod(m, char *) + off);
+ hbh = (struct ip6_hbh *)(mtod(*mp, char *) + off);
off += hbhlen;
hbhlen -= sizeof(struct ip6_hbh);
- if (ip6_process_hopopts(m, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
- hbhlen, rtalertp) < 0) {
+ if (ip6_process_hopopts(*mp, (u_int8_t *)hbh + sizeof(struct ip6_hbh),
+ hbhlen, rtalertp) < 0) {
*mp = NULL;
return (-1);
}
*offp = off;
- *mp = m;
return (0);
}
diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c
--- a/sys/netinet6/ip6_mroute.c
+++ b/sys/netinet6/ip6_mroute.c
@@ -1846,12 +1846,9 @@
* Make sure that the IP6 and PIM headers in contiguous memory, and
* possibly the PIM REGISTER header
*/
- if (m->m_len < off + minlen) {
- m = m_pullup(m, off + minlen);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + minlen)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
pim = (struct pim *)((char *)ip6 + off);
diff --git a/sys/netinet6/mld6.c b/sys/netinet6/mld6.c
--- a/sys/netinet6/mld6.c
+++ b/sys/netinet6/mld6.c
@@ -1196,17 +1196,15 @@
int mldlen;
m = *mp;
+ *mp = NULL;
CTR3(KTR_MLD, "%s: called w/mbuf (%p,%d)", __func__, m, off);
ifp = m->m_pkthdr.rcvif;
/* Pullup to appropriate size. */
- if (m->m_len < off + sizeof(*mld)) {
- m = m_pullup(m, off + sizeof(*mld));
- if (m == NULL) {
- ICMP6STAT_INC(icp6s_badlen);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + sizeof(*mld))) == NULL) {
+ ICMP6STAT_INC(icp6s_badlen);
+ return (IPPROTO_DONE);
}
mld = (struct mld_hdr *)(mtod(m, uint8_t *) + off);
if (mld->mld_type == MLD_LISTENER_QUERY &&
@@ -1215,12 +1213,9 @@
} else {
mldlen = sizeof(struct mld_hdr);
}
- if (m->m_len < off + mldlen) {
- m = m_pullup(m, off + mldlen);
- if (m == NULL) {
- ICMP6STAT_INC(icp6s_badlen);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + mldlen)) == NULL) {
+ ICMP6STAT_INC(icp6s_badlen);
+ return (IPPROTO_DONE);
}
*mp = m;
ip6 = mtod(m, struct ip6_hdr *);
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -172,12 +172,9 @@
goto bads;
}
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
ip6 = mtod(m, struct ip6_hdr *);
nd_ns = (struct nd_neighbor_solicit *)((char *)ip6 + off);
@@ -710,12 +707,9 @@
goto bad;
}
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
ip6 = mtod(m, struct ip6_hdr *);
nd_na = (struct nd_neighbor_advert *)((char *)ip6 + off);
diff --git a/sys/netinet6/nd6_rtr.c b/sys/netinet6/nd6_rtr.c
--- a/sys/netinet6/nd6_rtr.c
+++ b/sys/netinet6/nd6_rtr.c
@@ -205,12 +205,9 @@
if (IN6_IS_ADDR_UNSPECIFIED(&saddr6))
goto freeit;
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
ip6 = mtod(m, struct ip6_hdr *);
nd_rs = (struct nd_router_solicit *)((char *)ip6 + off);
@@ -550,14 +547,11 @@
goto bad;
}
- if (m->m_len < off + icmp6len) {
- m = m_pullup(m, off + icmp6len);
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- return;
- }
- ip6 = mtod(m, struct ip6_hdr *);
+ if ((m = m_pullup(m, off + icmp6len)) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return;
}
+ ip6 = mtod(m, struct ip6_hdr *);
nd_ra = (struct nd_router_advert *)((char *)ip6 + off);
icmp6len -= sizeof(*nd_ra);
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -439,8 +439,7 @@
*/
if (inp->inp_ip_p == IPPROTO_ICMPV6) {
struct icmp6_hdr *icmp6;
- if (m->m_len < sizeof(struct icmp6_hdr) &&
- (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
+ if ((m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
error = ENOBUFS;
goto bad;
}
diff --git a/sys/netinet6/route6.c b/sys/netinet6/route6.c
--- a/sys/netinet6/route6.c
+++ b/sys/netinet6/route6.c
@@ -62,31 +62,13 @@
struct mbuf *m;
struct ip6_rthdr *rh;
int off = *offp, rhlen;
-#ifdef __notyet__
- struct ip6aux *ip6a;
-#endif
m = *mp;
+ *mp = NULL; /* Consumed in most cases. */
-#ifdef __notyet__
- ip6a = ip6_findaux(m);
- if (ip6a) {
- /* XXX reject home-address option before rthdr */
- if (ip6a->ip6a_flags & IP6A_SWAP) {
- IP6STAT_INC(ip6s_badoptions);
- m_freem(m);
- return IPPROTO_DONE;
- }
- }
-#endif
-
- if (m->m_len < off + sizeof(*rh)) {
- m = m_pullup(m, off + sizeof(*rh));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, off + sizeof(*rh))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
rh = (struct ip6_rthdr *)((char *)ip6 + off);
@@ -104,8 +86,7 @@
}
IP6STAT_INC(ip6s_badoptions);
icmp6_error(m, ICMP6_PARAM_PROB, ICMP6_PARAMPROB_HEADER,
- (char *)&rh->ip6r_type - (char *)ip6);
- *mp = NULL;
+ (char *)&rh->ip6r_type - (char *)ip6);
return (IPPROTO_DONE);
}
diff --git a/sys/netinet6/sctp6_usrreq.c b/sys/netinet6/sctp6_usrreq.c
--- a/sys/netinet6/sctp6_usrreq.c
+++ b/sys/netinet6/sctp6_usrreq.c
@@ -100,12 +100,9 @@
SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
/* Get IP, SCTP, and first chunk header together in the first mbuf. */
offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
- if (m->m_len < offset) {
- m = m_pullup(m, offset);
- if (m == NULL) {
- SCTP_STAT_INCR(sctps_hdrops);
- return (IPPROTO_DONE);
- }
+ if ((m = m_pullup(m, offset)) == NULL) {
+ SCTP_STAT_INCR(sctps_hdrops);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
sh = (struct sctphdr *)(mtod(m, caddr_t)+iphlen);
diff --git a/sys/netinet6/send.c b/sys/netinet6/send.c
--- a/sys/netinet6/send.c
+++ b/sys/netinet6/send.c
@@ -124,13 +124,9 @@
switch (direction) {
case SND_IN:
- if (m->m_len < (sizeof(struct ip6_hdr) +
- sizeof(struct icmp6_hdr))) {
- m = m_pullup(m, sizeof(struct ip6_hdr) +
- sizeof(struct icmp6_hdr));
- if (!m)
- return (ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr) +
+ sizeof(struct icmp6_hdr))) == NULL)
+ return (ENOBUFS);
/* Before passing off the mbuf record the proper interface. */
m->m_pkthdr.rcvif = ifp;
@@ -175,11 +171,8 @@
return (error);
case SND_OUT:
- if (m->m_len < sizeof(struct ip6_hdr)) {
- m = m_pullup(m, sizeof(struct ip6_hdr));
- if (!m)
- return (ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL)
+ return (ENOBUFS);
ip6 = mtod(m, struct ip6_hdr *);
if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
m->m_flags |= M_MCAST;
diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c
--- a/sys/netinet6/udp6_usrreq.c
+++ b/sys/netinet6/udp6_usrreq.c
@@ -351,7 +351,7 @@
int
udp6_input(struct mbuf **mp, int *offp, int proto)
{
- struct mbuf *m = *mp;
+ struct mbuf *m;
struct ip6_hdr *ip6;
struct udphdr *uh;
struct inpcb *inp;
@@ -368,13 +368,13 @@
NET_EPOCH_ASSERT();
- if (m->m_len < off + sizeof(struct udphdr)) {
- m = m_pullup(m, off + sizeof(struct udphdr));
- if (m == NULL) {
- IP6STAT_INC(ip6s_exthdrtoolong);
- *mp = NULL;
- return (IPPROTO_DONE);
- }
+ /* Always consumed. */
+ m = *mp;
+ *mp = NULL;
+
+ if ((m = m_pullup(m, off + sizeof(struct udphdr))) == NULL) {
+ IP6STAT_INC(ip6s_exthdrtoolong);
+ return (IPPROTO_DONE);
}
ip6 = mtod(m, struct ip6_hdr *);
uh = (struct udphdr *)((char *)ip6 + off);
@@ -456,10 +456,8 @@
fromsa[1].sin6_port = uh->uh_dport;
pcbinfo = udp_get_inpcbinfo(nxt);
- if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
- *mp = NULL;
+ if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
return (udp6_multi_input(m, off, proto, fromsa));
- }
/*
* Locate pcb for datagram.
@@ -529,7 +527,6 @@
!in6_localip(&ip6->ip6_src)))
goto badunlocked;
icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
- *mp = NULL;
return (IPPROTO_DONE);
}
INP_RLOCK_ASSERT(inp);
@@ -538,7 +535,6 @@
if (up->u_rxcslen == 0 || up->u_rxcslen > ulen) {
INP_RUNLOCK(inp);
m_freem(m);
- *mp = NULL;
return (IPPROTO_DONE);
}
}
@@ -548,12 +544,10 @@
UDP_PROBE(receive, NULL, inp, ip6, inp, uh);
if (udp6_append(inp, m, off, fromsa) == 0)
INP_RUNLOCK(inp);
- *mp = NULL;
return (IPPROTO_DONE);
badunlocked:
m_freem(m);
- *mp = NULL;
return (IPPROTO_DONE);
}
diff --git a/sys/netipsec/ipsec_input.c b/sys/netipsec/ipsec_input.c
--- a/sys/netipsec/ipsec_input.c
+++ b/sys/netipsec/ipsec_input.c
@@ -364,7 +364,7 @@
/*
* Fix IPv4 header
*/
- if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
+ if ((m = m_pullup(m, skip)) == NULL) {
DPRINTF(("%s: processing failed for SA %s/%08lx\n",
__func__, ipsec_address(&sav->sah->saidx.dst,
buf, sizeof(buf)), (u_long) ntohl(sav->spi)));
@@ -620,8 +620,7 @@
NET_EPOCH_ENTER(et);
/* Fix IPv6 header */
- if (m->m_len < sizeof(struct ip6_hdr) &&
- (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
+ if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
DPRINTF(("%s: processing failed for SA %s/%08lx\n",
__func__, ipsec_address(&sav->sah->saidx.dst, buf,
sizeof(buf)), (u_long) ntohl(sav->spi)));
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -2225,11 +2225,9 @@
if (!n)
return key_senderror(so, m, ENOBUFS);
- if (n->m_len < sizeof(*newmsg)) {
- n = m_pullup(n, sizeof(*newmsg));
- if (!n)
- return key_senderror(so, m, ENOBUFS);
- }
+ if ((n = m_pullup(n, sizeof(*newmsg))) == NULL)
+ return key_senderror(so, m, ENOBUFS);
+
newmsg = mtod(n, struct sadb_msg *);
newmsg->sadb_msg_errno = 0;
newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
@@ -2809,11 +2807,8 @@
if ((result->m_flags & M_PKTHDR) == 0)
goto fail;
- if (result->m_len < sizeof(struct sadb_msg)) {
- result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL)
- goto fail;
- }
+ if ((result = m_pullup(result, sizeof(struct sadb_msg))) == NULL)
+ goto fail;
result->m_pkthdr.len = 0;
for (m = result; m; m = m->m_next)
@@ -2946,12 +2941,9 @@
goto fail;
}
- if (result->m_len < sizeof(struct sadb_msg)) {
- result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL) {
- error = ENOBUFS;
- goto fail;
- }
+ if ((result = m_pullup(result, sizeof(struct sadb_msg))) == NULL) {
+ error = ENOBUFS;
+ goto fail;
}
result->m_pkthdr.len = 0;
@@ -3957,11 +3949,8 @@
m_cat(result, tres);
tres = NULL;
- if (result->m_len < sizeof(struct sadb_msg)) {
- result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL)
- goto fail;
- }
+ if ((result = m_pullup(result, sizeof(struct sadb_msg))) == NULL)
+ goto fail;
result->m_pkthdr.len = 0;
for (m = result; m; m = m->m_next)
@@ -5207,11 +5196,8 @@
goto fail;
}
- if (n->m_len < sizeof(struct sadb_msg)) {
- n = m_pullup(n, sizeof(struct sadb_msg));
- if (n == NULL)
- return key_sendup_mbuf(so, m, KEY_SENDUP_ONE);
- }
+ if ((n = m_pullup(n, sizeof(struct sadb_msg))) == NULL)
+ return (key_sendup_mbuf(so, m, KEY_SENDUP_ONE));
n->m_pkthdr.len = 0;
for (nn = n; nn; nn = nn->m_next)
@@ -6278,11 +6264,9 @@
if (!n)
return NULL;
- if (n->m_len < sizeof(struct sadb_msg)) {
- n = m_pullup(n, sizeof(struct sadb_msg));
- if (n == NULL)
- return NULL;
- }
+ if ((n = m_pullup(n, sizeof(struct sadb_msg))) == NULL)
+ return NULL;
+
mtod(n, struct sadb_msg *)->sadb_msg_errno = 0;
mtod(n, struct sadb_msg *)->sadb_msg_len =
PFKEY_UNIT64(n->m_pkthdr.len);
@@ -6389,11 +6373,9 @@
if (!n)
return key_senderror(so, m, ENOBUFS);
- if (n->m_len < sizeof(struct sadb_msg)) {
- n = m_pullup(n, sizeof(struct sadb_msg));
- if (n == NULL)
- return key_senderror(so, m, ENOBUFS);
- }
+ if ((n = m_pullup(n, sizeof(struct sadb_msg))) == NULL)
+ return (key_senderror(so, m, ENOBUFS));
+
newmsg = mtod(n, struct sadb_msg *);
newmsg->sadb_msg_errno = 0;
newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
@@ -6451,11 +6433,9 @@
if (!n)
return key_senderror(so, m, ENOBUFS);
- if (n->m_len < sizeof(struct sadb_msg)) {
- n = m_pullup(n, sizeof(struct sadb_msg));
- if (n == NULL)
- return key_senderror(so, m, ENOBUFS);
- }
+ if ((n = m_pullup(n, sizeof(struct sadb_msg))) == NULL)
+ return (key_senderror(so, m, ENOBUFS));
+
newmsg = mtod(n, struct sadb_msg *);
newmsg->sadb_msg_errno = 0;
newmsg->sadb_msg_len = PFKEY_UNIT64(n->m_pkthdr.len);
@@ -7092,12 +7072,9 @@
goto fail;
}
- if (result->m_len < sizeof(struct sadb_msg)) {
- result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL) {
- error = ENOBUFS;
- goto fail;
- }
+ if ((result = m_pullup(result, sizeof(struct sadb_msg))) == NULL) {
+ error = ENOBUFS;
+ goto fail;
}
result->m_pkthdr.len = 0;
@@ -7733,12 +7710,9 @@
goto fail;
}
- if (result->m_len < sizeof(struct sadb_msg)) {
- result = m_pullup(result, sizeof(struct sadb_msg));
- if (result == NULL) {
- error = ENOBUFS;
- goto fail;
- }
+ if ((result = m_pullup(result, sizeof(struct sadb_msg))) == NULL) {
+ error = ENOBUFS;
+ goto fail;
}
result->m_pkthdr.len = 0;
@@ -8102,11 +8076,9 @@
IPSEC_ASSERT(so != NULL, ("null socket"));
IPSEC_ASSERT(m != NULL, ("null mbuf"));
- if (m->m_len < sizeof(struct sadb_msg)) {
- m = m_pullup(m, sizeof(struct sadb_msg));
- if (!m)
- return ENOBUFS;
- }
+ if ((m = m_pullup(m, sizeof(struct sadb_msg))) == NULL)
+ return ENOBUFS;
+
msg = mtod(m, struct sadb_msg *);
orglen = PFKEY_UNUNIT64(msg->sadb_msg_len);
target = KEY_SENDUP_ONE;
diff --git a/sys/netipsec/keysock.c b/sys/netipsec/keysock.c
--- a/sys/netipsec/keysock.c
+++ b/sys/netipsec/keysock.c
@@ -109,12 +109,10 @@
goto end;
}
- if (m->m_len < sizeof(struct sadb_msg)) {
- if ((m = m_pullup(m, sizeof(struct sadb_msg))) == NULL) {
- PFKEYSTAT_INC(out_nomem);
- error = ENOBUFS;
- goto end;
- }
+ if ((m = m_pullup(m, sizeof(struct sadb_msg))) == NULL) {
+ PFKEYSTAT_INC(out_nomem);
+ error = ENOBUFS;
+ goto end;
}
M_ASSERTPKTHDR(m);
@@ -189,12 +187,9 @@
PFKEYSTAT_INC(in_total);
PFKEYSTAT_ADD(in_bytes, m->m_pkthdr.len);
- if (m->m_len < sizeof(struct sadb_msg)) {
- m = m_pullup(m, sizeof(struct sadb_msg));
- if (m == NULL) {
- PFKEYSTAT_INC(in_nomem);
- return (ENOBUFS);
- }
+ if ((m = m_pullup(m, sizeof(struct sadb_msg))) == NULL) {
+ PFKEYSTAT_INC(in_nomem);
+ return (ENOBUFS);
}
if (m->m_len >= sizeof(struct sadb_msg)) {
struct sadb_msg *msg;
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c
--- a/sys/netipsec/xform_ah.c
+++ b/sys/netipsec/xform_ah.c
@@ -553,14 +553,11 @@
/* Figure out header size. */
rplen = HDRSIZE(sav);
- if (m->m_len < skip + rplen) {
- m = m_pullup(m, skip + rplen);
- if (m == NULL) {
- DPRINTF(("ah_input: cannot pullup header\n"));
- AHSTAT_INC(ahs_hdrops); /*XXX*/
- error = ENOBUFS;
- goto bad;
- }
+ if ((m = m_pullup(m, skip + rplen)) == NULL) {
+ DPRINTF(("ah_input: cannot pullup header\n"));
+ AHSTAT_INC(ahs_hdrops); /*XXX*/
+ error = ENOBUFS;
+ goto bad;
}
ah = (struct newah *)(mtod(m, caddr_t) + skip);
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -293,14 +293,11 @@
goto bad;
}
- if (m->m_len < skip + sizeof(*esp)) {
- m = m_pullup(m, skip + sizeof(*esp));
- if (m == NULL) {
- DPRINTF(("%s: cannot pullup header\n", __func__));
- ESPSTAT_INC(esps_hdrops); /*XXX*/
- error = ENOBUFS;
- goto bad;
- }
+ if ((m = m_pullup(m, skip + sizeof(*esp))) == NULL) {
+ DPRINTF(("%s: cannot pullup header\n", __func__));
+ ESPSTAT_INC(esps_hdrops); /*XXX*/
+ error = ENOBUFS;
+ goto bad;
}
esp = (struct newesp *)(mtod(m, caddr_t) + skip);
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c
--- a/sys/netipsec/xform_ipcomp.c
+++ b/sys/netipsec/xform_ipcomp.c
@@ -212,7 +212,7 @@
* compression it means someone is playing tricks on us.
*/
error = ENOBUFS;
- if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
+ if ((m = m_pullup(m, skip + hlen)) == NULL) {
IPCOMPSTAT_INC(ipcomps_hdrops); /*XXX*/
DPRINTF(("%s: m_pullup failed\n", __func__));
key_freesav(&sav);
@@ -347,7 +347,7 @@
/* In case it's not done already, adjust the size of the mbuf chain */
m->m_pkthdr.len = clen + hlen + skip;
- if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) {
+ if ((m = m_pullup(m, skip + hlen)) == NULL) {
IPCOMPSTAT_INC(ipcomps_hdrops); /*XXX*/
DPRINTF(("%s: m_pullup failed\n", __func__));
error = EINVAL; /*XXX*/
diff --git a/sys/netpfil/ipfw/ip_dn_io.c b/sys/netpfil/ipfw/ip_dn_io.c
--- a/sys/netpfil/ipfw/ip_dn_io.c
+++ b/sys/netpfil/ipfw/ip_dn_io.c
@@ -813,8 +813,7 @@
* contiguous in the first mbuf header.
* Insure this is true.
*/
- if (m->m_len < ETHER_HDR_LEN &&
- (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
+ if ((m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
printf("dummynet/ether: pullup failed, "
"dropping packet\n");
break;
diff --git a/sys/netpfil/ipfw/ip_fw2.c b/sys/netpfil/ipfw/ip_fw2.c
--- a/sys/netpfil/ipfw/ip_fw2.c
+++ b/sys/netpfil/ipfw/ip_fw2.c
@@ -1531,16 +1531,14 @@
goto pullup_failed; \
(_p) = (__typeof(_p))((char *)args->mem + hlen + ehlen);\
} else { \
- if (__predict_false(m->m_len < _max)) { \
- args->m = m = m_pullup(m, _max); \
- if (m == NULL) \
- goto pullup_failed; \
- if (eh != NULL) { \
- eh = mtod(m, struct ether_header *); \
- ip = (struct ip *)(eh + 1); \
- } else \
- ip = mtod(m, struct ip *); \
- } \
+ args->m = m = m_pullup(m, _max); \
+ if (__predict_false((m == NULL))) \
+ goto pullup_failed; \
+ if (eh != NULL) { \
+ eh = mtod(m, struct ether_header *); \
+ ip = (struct ip *)(eh + 1); \
+ } else \
+ ip = mtod(m, struct ip *); \
(_p) = (__typeof(_p))(mtod(m, char *) + hlen + ehlen); \
} \
} while (0)
diff --git a/sys/netpfil/ipfw/nat64/nat64_translate.c b/sys/netpfil/ipfw/nat64/nat64_translate.c
--- a/sys/netpfil/ipfw/nat64/nat64_translate.c
+++ b/sys/netpfil/ipfw/nat64/nat64_translate.c
@@ -908,8 +908,7 @@
int len, hlen, plen;
uint8_t type, code;
- if (m->m_len < offset + ICMP_MINLEN)
- m = m_pullup(m, offset + ICMP_MINLEN);
+ m = m_pullup(m, offset + ICMP_MINLEN);
if (m == NULL) {
NAT64STAT_INC(&cfg->stats, nomem);
return (m);
@@ -1490,8 +1489,7 @@
* The only two things we should be provided with are mapping between
* IPv6iHost <> alias_host and between dport and alias_port.
*/
- if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN)
- m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
+ m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
if (m == NULL) {
NAT64STAT_INC(&cfg->stats, nomem);
return (NAT64RETURN);
diff --git a/sys/netpfil/ipfw/nat64/nat64clat.c b/sys/netpfil/ipfw/nat64/nat64clat.c
--- a/sys/netpfil/ipfw/nat64/nat64clat.c
+++ b/sys/netpfil/ipfw/nat64/nat64clat.c
@@ -175,8 +175,7 @@
NAT64STAT_INC(stats, dropped);
return (NAT64MFREE);
}
- if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN)
- m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
+ m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
if (m == NULL) {
NAT64STAT_INC(stats, nomem);
return (NAT64RETURN);
diff --git a/sys/netpfil/ipfw/nat64/nat64lsn.c b/sys/netpfil/ipfw/nat64/nat64lsn.c
--- a/sys/netpfil/ipfw/nat64/nat64lsn.c
+++ b/sys/netpfil/ipfw/nat64/nat64lsn.c
@@ -421,8 +421,7 @@
ip = mtod(*mp, struct ip *); /* Outer IP header */
off = (ip->ip_hl << 2) + ICMP_MINLEN;
- if ((*mp)->m_len < off)
- *mp = m_pullup(*mp, off);
+ *mp = m_pullup(*mp, off);
if (*mp == NULL)
return (ENOMEM);
@@ -446,16 +445,14 @@
*/
if ((*mp)->m_pkthdr.len < off + sizeof(struct ip) + ICMP_MINLEN)
return (EINVAL);
- if ((*mp)->m_len < off + sizeof(struct ip) + ICMP_MINLEN)
- *mp = m_pullup(*mp, off + sizeof(struct ip) + ICMP_MINLEN);
+ *mp = m_pullup(*mp, off + sizeof(struct ip) + ICMP_MINLEN);
if (*mp == NULL)
return (ENOMEM);
ip = mtodo(*mp, off); /* Inner IP header */
inner_proto = ip->ip_p;
off += ip->ip_hl << 2; /* Skip inner IP header */
*addr = ntohl(ip->ip_src.s_addr);
- if ((*mp)->m_len < off + ICMP_MINLEN)
- *mp = m_pullup(*mp, off + ICMP_MINLEN);
+ *mp = m_pullup(*mp, off + ICMP_MINLEN);
if (*mp == NULL)
return (ENOMEM);
switch (inner_proto) {
@@ -578,14 +575,11 @@
NAT64STAT_INC(&cfg->base.stats, noproto);
return (NULL);
}
- if (m->m_len < len) {
- m = m_pullup(m, len);
- if (m == NULL) {
- NAT64STAT_INC(&cfg->base.stats, nomem);
- return (NULL);
- }
- ip = mtod(m, struct ip *);
+ if ((m = m_pullup(m, len)) == NULL) {
+ NAT64STAT_INC(&cfg->base.stats, nomem);
+ return (NULL);
}
+ ip = mtod(m, struct ip *);
switch (ip->ip_p) {
case IPPROTO_TCP:
*port = ntohs(L3HDR(ip, struct tcphdr *)->th_dport);
diff --git a/sys/netpfil/ipfw/nat64/nat64stl.c b/sys/netpfil/ipfw/nat64/nat64stl.c
--- a/sys/netpfil/ipfw/nat64/nat64stl.c
+++ b/sys/netpfil/ipfw/nat64/nat64stl.c
@@ -175,8 +175,7 @@
NAT64STAT_INC(stats, dropped);
return (NAT64MFREE);
}
- if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN)
- m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
+ m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
if (m == NULL) {
NAT64STAT_INC(stats, nomem);
return (NAT64RETURN);
diff --git a/sys/netpfil/ipfw/nptv6/nptv6.c b/sys/netpfil/ipfw/nptv6/nptv6.c
--- a/sys/netpfil/ipfw/nptv6/nptv6.c
+++ b/sys/netpfil/ipfw/nptv6/nptv6.c
@@ -166,8 +166,7 @@
offset += sizeof(*icmp6);
if (offset + sizeof(*ip6) > m->m_pkthdr.len)
return (-1);
- if (offset + sizeof(*ip6) > m->m_len)
- *mp = m = m_pullup(m, offset + sizeof(*ip6));
+ *mp = m = m_pullup(m, offset + sizeof(*ip6));
if (m == NULL)
return (-1);
ip6 = mtodo(m, offset);
diff --git a/sys/netpfil/ipfw/pmod/tcpmod.c b/sys/netpfil/ipfw/pmod/tcpmod.c
--- a/sys/netpfil/ipfw/pmod/tcpmod.c
+++ b/sys/netpfil/ipfw/pmod/tcpmod.c
@@ -67,16 +67,14 @@
m = *mp;
ret = IP_FW_DENY;
- if (m->m_len < m->m_pkthdr.len) {
- /*
- * We shouldn't have any data, IP packet contains only
- * TCP header with options.
- */
- *mp = m = m_pullup(m, m->m_pkthdr.len);
- if (m == NULL) {
- *done = 1;
- return (ret);
- }
+ /*
+ * We shouldn't have any data, IP packet contains only
+ * TCP header with options.
+ */
+ *mp = m = m_pullup(m, m->m_pkthdr.len);
+ if (m == NULL) {
+ *done = 1;
+ return (ret);
}
/* Parse TCP options. */
for (tlen -= sizeof(struct tcphdr), cp = (u_char *)(tcp + 1);
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -978,13 +978,11 @@
goto done;
}
- if (offset + sizeof(*ph) > m->m_len) {
- if ((m = m_pullup(m, offset + sizeof(*ph))) == NULL) {
- V_pfsyncstats.pfsyncs_hdrops++;
- return (IPPROTO_DONE);
- }
- ip = mtod(m, struct ip *);
+ if ((m = m_pullup(m, offset + sizeof(*ph))) == NULL) {
+ V_pfsyncstats.pfsyncs_hdrops++;
+ return (IPPROTO_DONE);
}
+ ip = mtod(m, struct ip *);
ph = (struct pfsync_header *)((char *)ip + offset);
/* verify the version */
@@ -1081,13 +1079,11 @@
goto done;
}
- if (offset + sizeof(*ph) > m->m_len) {
- if ((m = m_pullup(m, offset + sizeof(*ph))) == NULL) {
- V_pfsyncstats.pfsyncs_hdrops++;
- return (IPPROTO_DONE);
- }
- ip6 = mtod(m, struct ip6_hdr *);
+ if ((m = m_pullup(m, offset + sizeof(*ph))) == NULL) {
+ V_pfsyncstats.pfsyncs_hdrops++;
+ return (IPPROTO_DONE);
}
+ ip6 = mtod(m, struct ip6_hdr *);
ph = (struct pfsync_header *)((char *)ip6 + offset);
/* verify the version */
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -5795,8 +5795,7 @@
return (PF_PASS);
}
- if (__predict_false(m->m_len < sizeof(struct ether_header)) &&
- (m = *m0 = m_pullup(*m0, sizeof(struct ether_header))) == NULL) {
+ if ((m = *m0 = m_pullup(*m0, sizeof(struct ether_header))) == NULL) {
DPFPRINTF(PF_DEBUG_URGENT,
"%s: m_len < sizeof(struct ether_header)"
", pullup failed", __func__);
@@ -11313,8 +11312,7 @@
case AF_INET: {
struct ip *h;
- if (__predict_false((*m0)->m_len < sizeof(struct ip)) &&
- (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
+ if ((pd->m = *m0 = m_pullup(*m0, sizeof(struct ip))) == NULL) {
DPFPRINTF(PF_DEBUG_URGENT,
"%s: m_len < sizeof(struct ip), pullup failed",
__func__);
@@ -11364,8 +11362,7 @@
case AF_INET6: {
struct ip6_hdr *h;
- if (__predict_false((*m0)->m_len < sizeof(struct ip6_hdr)) &&
- (pd->m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
+ if ((pd->m = *m0 = m_pullup(*m0, sizeof(struct ip6_hdr))) == NULL) {
DPFPRINTF(PF_DEBUG_URGENT,
"%s: m_len < sizeof(struct ip6_hdr)"
", pullup failed", __func__);

File Metadata

Mime Type
text/plain
Expires
Fri, Oct 16, 2:59 PM (21 h, 52 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
40898626
Default Alt Text
D60689.id189951.diff (96 KB)

Event Timeline