From fe6fb873dccf3eecf656f9af82031d05fe36ae57 Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Wed, 18 Dec 2002 15:34:17 +0000 Subject: Under some circumstances, the loopback interface will allocate a new mbuf for a packet looping back to provide alignment guarantees for KAME. Unfortunately, this code performs a direct copy of the header rather than using a header copying primitive (largely because we have sucky header copying primitives). This results in a multiple free of the MAC label in the header when the same label data is freed twice when the two mbufs with that header are freed. As a temporary work-around, clear the initialized flag on the label to prevent the duplicate free, which prevents panics on large unaligned loopback IP and IPv6 data. The real fix is to improve and make use of proper packet header copying routines here. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/net/if_loop.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'sys') diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c index b4fc8b5505df..9c3affca973c 100644 --- a/sys/net/if_loop.c +++ b/sys/net/if_loop.c @@ -42,10 +42,12 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_ipx.h" +#include "opt_mac.h" #include #include #include +#include #include #include #include @@ -225,6 +227,14 @@ looutput(ifp, m, dst, rt) n->m_pkthdr = m->m_pkthdr; n->m_len = m->m_pkthdr.len; SLIST_INIT(&m->m_pkthdr.tags); +#ifdef MAC + /* + * XXXMAC: Once we put labels in tags and proper + * primitives are used for relocating mbuf header + * data, this will no longer be required. + */ + m->m_pkthdr.label.l_flags &= ~MAC_FLAG_INITIALIZED; +#endif m_freem(m); m = n; } -- cgit v1.3