From ca80e9cf3a1abc38b54e4aa4b95923cde9b9cd04 Mon Sep 17 00:00:00 2001 From: Pyun YongHyeon Date: Sun, 24 Oct 2010 21:14:01 +0000 Subject: MFC r213844: Make sure to not use stale ip/tcp header pointers. The ip/tcp header parser uses m_pullup(9) to get access to mbuf chain. m_pullup(9) can allocate new mbuf chain and free old one if the space left in the mbuf chain is not enough to hold requested contiguous bytes. Previously drivers can use stale ip/tcp header pointer if m_pullup(9) returned new mbuf chain. Reported by: Andrew Boyer (aboyer <> averesystems dot com) --- sys/dev/bce/if_bce.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'sys/dev/bce') diff --git a/sys/dev/bce/if_bce.c b/sys/dev/bce/if_bce.c index 1272cd5f02e7..07885c3f9788 100644 --- a/sys/dev/bce/if_bce.c +++ b/sys/dev/bce/if_bce.c @@ -6733,6 +6733,7 @@ bce_tso_setup(struct bce_softc *sc, struct mbuf **m_head, u16 *flags) } /* Get the TCP header length in bytes (min 20) */ + ip = (struct ip *)(m->m_data + sizeof(struct ether_header)); th = (struct tcphdr *)((caddr_t)ip + ip_hlen); tcp_hlen = (th->th_off << 2); @@ -6745,6 +6746,7 @@ bce_tso_setup(struct bce_softc *sc, struct mbuf **m_head, u16 *flags) } /* IP header length and checksum will be calc'd by hardware */ + ip = (struct ip *)(m->m_data + sizeof(struct ether_header)); ip_len = ip->ip_len; ip->ip_len = 0; ip->ip_sum = 0; -- cgit v1.3