Page MenuHomeFreeBSD
Files F177570555

D61572.1794767843.diff
No OneTemporary
Actions

Authored By
Unknown
Size
1 KB
Referenced Files
None
Subscribers
None

D61572.1794767843.diff
View Options

diff --git a/lib/libnvmf/nvmf_tcp.c b/lib/libnvmf/nvmf_tcp.c
--- a/lib/libnvmf/nvmf_tcp.c
+++ b/lib/libnvmf/nvmf_tcp.c
@@ -245,10 +245,9 @@
/* Determine how large of a PDU header to return for errors. */
ch = pdu->hdr;
- hlen = ch->hlen;
plen = le32toh(ch->plen);
- if (hlen < sizeof(*ch) || hlen > plen)
- hlen = sizeof(*ch);
+ hlen = MIN(ch->hlen, plen);
+ hlen = MAX(hlen, sizeof(*ch));
error = nvmf_tcp_validate_pdu_header(ch,
qp->qp.nq_association->na_controller, qp->header_digests,
@@ -331,10 +330,10 @@
plen = le32toh(ch.plen);
/*
- * Validate a header with garbage lengths to trigger
- * an error message without reading more.
+ * Validate a header with too short plen to trigger an error
+ * message without reading more.
*/
- if (plen < sizeof(ch) || ch.hlen > plen) {
+ if (plen < sizeof(ch)) {
pdu->hdr = &ch;
error = nvmf_tcp_validate_pdu(qp, pdu, sizeof(ch));
pdu->hdr = NULL;
diff --git a/sys/dev/nvmf/nvmf_tcp.c b/sys/dev/nvmf/nvmf_tcp.c
--- a/sys/dev/nvmf/nvmf_tcp.c
+++ b/sys/dev/nvmf/nvmf_tcp.c
@@ -315,10 +315,9 @@
/* Determine how large of a PDU header to return for errors. */
ch = pdu->hdr;
- hlen = ch->hlen;
plen = le32toh(ch->plen);
- if (hlen < sizeof(*ch) || hlen > plen)
- hlen = sizeof(*ch);
+ hlen = MIN(ch->hlen, plen);
+ hlen = MAX(hlen, sizeof(*ch));
error = nvmf_tcp_validate_pdu_header(ch, qp->qp.nq_controller,
qp->header_digests, qp->data_digests, qp->rxpda, &data_len, &fes,
@@ -1146,9 +1145,9 @@
/*
* Malformed PDUs will be reported as errors
* by nvmf_tcp_validate_pdu. Just pass along
- * garbage headers if the lengths mismatch.
+ * garbage headers if the length is too short.
*/
- if (needed < sizeof(ch) || ch.hlen > needed)
+ if (needed < sizeof(ch))
needed = sizeof(ch);
memset(&uio, 0, sizeof(uio));

File Metadata

Mime Type
text/plain
Expires
Sun, Nov 15, 6:37 PM (19 h, 4 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41746853
Default Alt Text
D61572.1794767843.diff (1 KB)

Event Timeline