aboutsummaryrefslogtreecommitdiff
path: root/sys/netipsec
diff options
context:
space:
mode:
authorAndrey V. Elsukov <ae@FreeBSD.org>2018-04-26 12:23:31 +0000
committerAndrey V. Elsukov <ae@FreeBSD.org>2018-04-26 12:23:31 +0000
commitbf18dfa28ebccf42bfceef44db2c07caf2cc5020 (patch)
tree143a0b2e996785626216dc67e0629e4d5a16ff31 /sys/netipsec
parent4a381a9e4205ecba5cb9fcc6ed2cdd2846cb069b (diff)
downloadsrc-bf18dfa28ebccf42bfceef44db2c07caf2cc5020.tar.gz
src-bf18dfa28ebccf42bfceef44db2c07caf2cc5020.zip
Merge r1.22-1.23 from NetBSD:
Don't assume M_PKTHDR is set only on the first mbuf of the chain. The check is replaced by (m1 != m), which is equivalent to the previous code: we want to modify m->m_pkthdr.len only when 'm' was not passed in m_adj(). Fix a pretty bad mistake, that has always been there: m_adj(m1, -(m1->m_len - roff)); if (m1 != m) m->m_pkthdr.len -= (m1->m_len - roff); This is wrong: m_adj() will modify m1->m_len, so we're using a wrong value when manually adjusting m->m_pkthdr.len. Reported by: Maxime Villard <max at m00nbsd dot net> Obtained from: NetBSD MFC after: 1 week
Notes
Notes: svn path=/head/; revision=333016
Diffstat (limited to 'sys/netipsec')
-rw-r--r--sys/netipsec/ipsec_mbuf.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/netipsec/ipsec_mbuf.c b/sys/netipsec/ipsec_mbuf.c
index a640a23d8bc6..4127e06c9973 100644
--- a/sys/netipsec/ipsec_mbuf.c
+++ b/sys/netipsec/ipsec_mbuf.c
@@ -255,10 +255,11 @@ m_striphdr(struct mbuf *m, int skip, int hlen)
/* The header was at the beginning of the mbuf */
IPSECSTAT_INC(ips_input_front);
m_adj(m1, hlen);
- if ((m1->m_flags & M_PKTHDR) == 0)
+ if (m1 != m)
m->m_pkthdr.len -= hlen;
} else if (roff + hlen >= m1->m_len) {
struct mbuf *mo;
+ int adjlen;
/*
* Part or all of the header is at the end of this mbuf,
@@ -267,11 +268,13 @@ m_striphdr(struct mbuf *m, int skip, int hlen)
*/
IPSECSTAT_INC(ips_input_end);
if (roff + hlen > m1->m_len) {
+ adjlen = roff + hlen - m1->m_len;
+
/* Adjust the next mbuf by the remainder */
- m_adj(m1->m_next, roff + hlen - m1->m_len);
+ m_adj(m1->m_next, adjlen);
/* The second mbuf is guaranteed not to have a pkthdr... */
- m->m_pkthdr.len -= (roff + hlen - m1->m_len);
+ m->m_pkthdr.len -= adjlen;
}
/* Now, let's unlink the mbuf chain for a second...*/
@@ -279,9 +282,10 @@ m_striphdr(struct mbuf *m, int skip, int hlen)
m1->m_next = NULL;
/* ...and trim the end of the first part of the chain...sick */
- m_adj(m1, -(m1->m_len - roff));
- if ((m1->m_flags & M_PKTHDR) == 0)
- m->m_pkthdr.len -= (m1->m_len - roff);
+ adjlen = m1->m_len - roff;
+ m_adj(m1, -adjlen);
+ if (m1 != m)
+ m->m_pkthdr.len -= adjlen;
/* Finally, let's relink */
m1->m_next = mo;