d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid kernel panic when tcp rfc1323 and rfc1644 options are enabled

Browse Source 
at the same time.

   When rfc1323 and rfc1644 option are enabled by sysctl,
   and tcp over IPv6 is tried, kernel panic happens by the
   following check in tcp_output(), because now hdrlen is bigger
   in such case than before.

/*#ifdef DIAGNOSTIC*/
        if (max_linkhdr + hdrlen > MHLEN)
                panic("tcphdr too big");
/*#endif*/

   So change the above check to compare with MCLBYTES in #ifdef INET6 case.
   Also, allocate a mbuf cluster for the header mbuf, in that case.

Bug reported at KAME environment.
Approved by: jkh

Reviewed by: sumikawa
Obtained from: KAME project
This commit is contained in:
shin 2000-02-09 00:34:40 +00:00
parent 68e9f5dddb
commit 133260c413
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sys/netinet/tcp_output.c
View File

@ -530,8 +530,13 @@ tcp_output(tp)
}
/*#ifdef DIAGNOSTIC*/
#ifdef INET6
if (max_linkhdr + hdrlen > MCLBYTES)
panic("tcphdr too big");
#else
if (max_linkhdr + hdrlen > MHLEN)
panic("tcphdr too big");
#endif
/*#endif*/
/*
@ -567,10 +572,14 @@ tcp_output(tp)
goto out;
}
#ifdef INET6
if (isipv6 && (MHLEN < hdrlen + max_linkhdr) &&
MHLEN >= hdrlen) {
MH_ALIGN(m, hdrlen);
} else
if (MHLEN < hdrlen + max_linkhdr) {
MCLGET(m, M_DONTWAIT);
if ((m->m_flags & M_EXT) == 0) {
m_freem(m);
error = ENOBUFS;
goto out;
}
}
#endif
m->m_data += max_linkhdr;
m->m_len = hdrlen;