diff options
| author | Pyun YongHyeon <yongari@FreeBSD.org> | 2010-10-14 18:31:40 +0000 |
|---|---|---|
| committer | Pyun YongHyeon <yongari@FreeBSD.org> | 2010-10-14 18:31:40 +0000 |
| commit | 96486faa6e3d108519f23f602111c6422c3dd679 (patch) | |
| tree | a0e4e25c77486cf23be8641eed71e4b366b6078f /sys/dev/fxp | |
| parent | cb2f3e7f9be380a83926cb3163b573c92408e59d (diff) | |
| download | src-96486faa6e3d108519f23f602111c6422c3dd679.tar.gz src-96486faa6e3d108519f23f602111c6422c3dd679.zip | |
Make sure to not use stale ip/tcp header pointers. The ip/tcp
header parser uses m_pullup(9) to get access to mbuf chain.
m_pullup(9) can allocate new mbuf chain and free old one if the
space left in the mbuf chain is not enough to hold requested
contiguous bytes. Previously drivers can use stale ip/tcp header
pointer if m_pullup(9) returned new mbuf chain.
Reported by: Andrew Boyer (aboyer <> averesystems dot com)
MFC after: 10 days
Notes
Notes:
svn path=/head/; revision=213844
Diffstat (limited to 'sys/dev/fxp')
| -rw-r--r-- | sys/dev/fxp/if_fxp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/dev/fxp/if_fxp.c b/sys/dev/fxp/if_fxp.c index 079ecc1e82d9..6904d9ae9df2 100644 --- a/sys/dev/fxp/if_fxp.c +++ b/sys/dev/fxp/if_fxp.c @@ -1454,6 +1454,8 @@ fxp_encap(struct fxp_softc *sc, struct mbuf **m_head) * Since 82550/82551 doesn't modify IP length and pseudo * checksum in the first frame driver should compute it. */ + ip = (struct ip *)(mtod(m, char *) + ip_off); + tcp = (struct tcphdr *)(mtod(m, char *) + poff); ip->ip_sum = 0; ip->ip_len = htons(m->m_pkthdr.tso_segsz + (ip->ip_hl << 2) + (tcp->th_off << 2)); |