Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 7 Oct 2015 13:10:26 +0000 (UTC)
From:      Gleb Smirnoff <glebius@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r288991 - head/sys/netinet
Message-ID:  <201510071310.t97DAQ97023227@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: glebius
Date: Wed Oct  7 13:10:26 2015
New Revision: 288991
URL: https://svnweb.freebsd.org/changeset/base/288991

Log:
  Fix regression from r287779, that bite me. If we call m_pullup()
  unconditionally, we end up with an mbuf chain of two mbufs, which
  later in in_arpreply() is rewritten from ARP request to ARP reply
  and is sent out. Looks like igb(4) (at least mine, and at least
  at my network) fails on such mbuf chain, so ARP reply doesn't go
  out wire. Thus, make the m_pullup() call conditional, as it is
  everywhere. Of course, the bug in igb(?) should be investigated,
  but better first fix the head. And unconditional m_pullup() was
  suboptimal, anyway.

Modified:
  head/sys/netinet/if_ether.c

Modified: head/sys/netinet/if_ether.c
==============================================================================
--- head/sys/netinet/if_ether.c	Wed Oct  7 12:40:00 2015	(r288990)
+++ head/sys/netinet/if_ether.c	Wed Oct  7 13:10:26 2015	(r288991)
@@ -531,12 +531,15 @@ arpintr(struct mbuf *m)
 	ar = mtod(m, struct arphdr *);
 
 	/* Check if length is sufficient */
-	if ((m = m_pullup(m, arphdr_len(ar))) == NULL) {
-		ARP_LOG(LOG_NOTICE, "short packet received on %s\n",
-		    if_name(ifp));
-		return;
+	if (m->m_len <  arphdr_len(ar)) {
+		m = m_pullup(m, arphdr_len(ar));
+		if (m == NULL) {
+			ARP_LOG(LOG_NOTICE, "short packet received on %s\n",
+			    if_name(ifp));
+			return;
+		}
+		ar = mtod(m, struct arphdr *);
 	}
-	ar = mtod(m, struct arphdr *);
 
 	hlen = 0;
 	layer = "";



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201510071310.t97DAQ97023227>