diff options
| author | Zhenlei Huang <zlei.huang@gmail.com> | 2022-09-30 07:55:29 +0000 |
|---|---|---|
| committer | Zhenlei Huang <zlei@FreeBSD.org> | 2022-11-04 10:38:50 +0000 |
| commit | 0156c3f1f7608bb1ce547bed6b60cb084db3e7eb (patch) | |
| tree | a719381464f1278fe72e27dea40ef7e398bb506a | |
| parent | 3ee705d3c86d7370a1f9a93c18e60e868a78d9f4 (diff) | |
| download | src-0156c3f1f7608bb1ce547bed6b60cb084db3e7eb.tar.gz src-0156c3f1f7608bb1ce547bed6b60cb084db3e7eb.zip | |
if_vxlan(4): Check the size of data available in mbuf before using them
PR: 261711
Reviewed by: kp
Tested by: Alfa (burak.sn at outlook.com)
Approved by: kp (mentor)
Differential Revision: https://reviews.freebsd.org/D36794
(cherry picked from commit 8707cb19e68128c181477d87f960182c14e15f12)
| -rw-r--r-- | sys/net/if_vxlan.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/net/if_vxlan.c b/sys/net/if_vxlan.c index 63b4af0fc635..c8bb1ac53981 100644 --- a/sys/net/if_vxlan.c +++ b/sys/net/if_vxlan.c @@ -2822,6 +2822,12 @@ vxlan_input(struct vxlan_socket *vso, uint32_t vni, struct mbuf **m0, return (ENOENT); ifp = sc->vxl_ifp; + if (m->m_len < ETHER_HDR_LEN && + (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) { + *m0 = NULL; + error = ENOBUFS; + goto out; + } eh = mtod(m, struct ether_header *); if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) { |