d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a KASSERT() in tcp_output().

Browse Source 
When checking the length of the headers at this point, the IP level
options have not been added to the mbuf chain.
So don't take them into account.

Reported by:		syzbot+16025fff7ee5f7c5957b@syzkaller.appspotmail.com
Reported by:		syzbot+adb5836b8a9ff621b2aa@syzkaller.appspotmail.com
Reported by:		syzbot+d25a5352bcdf40acdbb8@syzkaller.appspotmail.com
Reviewed by:		rrs@
MFC after:		3 days
Sponsored by:		Netflix, Inc.
This commit is contained in:
Michael Tuexen 2019-03-23 09:56:41 +00:00
parent 4ee7d3b011
commit 05fb056c06
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/netinet/tcp_output.c
View File

@ -1284,15 +1284,9 @@ send:
m->m_pkthdr.tso_segsz = tp->t_maxseg - optlen; m->m_pkthdr.tso_segsz = tp->t_maxseg - optlen;
} }
#if defined(IPSEC) || defined(IPSEC_SUPPORT) KASSERT(len + hdrlen == m_length(m, NULL),
KASSERT(len + hdrlen + ipoptlen - ipsec_optlen == m_length(m, NULL), ("%s: mbuf chain shorter than expected: %d + %u != %u",
("%s: mbuf chain shorter than expected: %d + %u + %u - %u != %u", __func__, len, hdrlen, m_length(m, NULL)));
__func__, len, hdrlen, ipoptlen, ipsec_optlen, m_length(m, NULL)));
#else
KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL),
("%s: mbuf chain shorter than expected: %d + %u + %u != %u",
__func__, len, hdrlen, ipoptlen, m_length(m, NULL)));
#endif
#ifdef TCP_HHOOK #ifdef TCP_HHOOK
/* Run HHOOK_TCP_ESTABLISHED_OUT helper hooks. */ /* Run HHOOK_TCP_ESTABLISHED_OUT helper hooks. */