Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 24 Oct 2010 21:17:23 +0000 (UTC)
From:      Pyun YongHyeon <yongari@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org
Subject:   svn commit: r214296 - in stable/7/sys/dev: age alc ale bce bge fxp jme sge
Message-ID:  <201010242117.o9OLHN40040321@svn.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: yongari
Date: Sun Oct 24 21:17:23 2010
New Revision: 214296
URL: http://svn.freebsd.org/changeset/base/214296

Log:
  MFC r213844:
    Make sure to not use stale ip/tcp header pointers. The ip/tcp
    header parser uses m_pullup(9) to get access to mbuf chain.
    m_pullup(9) can allocate new mbuf chain and free old one if the
    space left in the mbuf chain is not enough to hold requested
    contiguous bytes. Previously drivers can use stale ip/tcp header
    pointer if m_pullup(9) returned new mbuf chain.
  
    Reported by:	Andrew Boyer (aboyer <> averesystems dot com)

Modified:
  stable/7/sys/dev/age/if_age.c
  stable/7/sys/dev/alc/if_alc.c
  stable/7/sys/dev/ale/if_ale.c
  stable/7/sys/dev/bce/if_bce.c
  stable/7/sys/dev/bge/if_bge.c
  stable/7/sys/dev/fxp/if_fxp.c
  stable/7/sys/dev/jme/if_jme.c
  stable/7/sys/dev/sge/if_sge.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/7/sys/dev/age/if_age.c
==============================================================================
--- stable/7/sys/dev/age/if_age.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/age/if_age.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -1565,6 +1565,7 @@ age_encap(struct age_softc *sc, struct m
 				*m_head = NULL;
 				return (ENOBUFS);
 			}
+			ip = (struct ip *)(mtod(m, char *) + ip_off);
 			tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 			/*
 			 * L1 requires IP/TCP header size and offset as

Modified: stable/7/sys/dev/alc/if_alc.c
==============================================================================
--- stable/7/sys/dev/alc/if_alc.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/alc/if_alc.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -2104,6 +2104,8 @@ alc_encap(struct alc_softc *sc, struct m
 			 * Reset IP checksum and recompute TCP pseudo
 			 * checksum as NDIS specification said.
 			 */
+			ip = (struct ip *)(mtod(m, char *) + ip_off);
+			tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 			ip->ip_sum = 0;
 			tcp->th_sum = in_pseudo(ip->ip_src.s_addr,
 			    ip->ip_dst.s_addr, htons(IPPROTO_TCP));

Modified: stable/7/sys/dev/ale/if_ale.c
==============================================================================
--- stable/7/sys/dev/ale/if_ale.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/ale/if_ale.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -1677,6 +1677,7 @@ ale_encap(struct ale_softc *sc, struct m
 				*m_head = NULL;
 				return (ENOBUFS);
 			}
+			ip = (struct ip *)(mtod(m, char *) + ip_off);
 			tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 			m = m_pullup(m, poff + (tcp->th_off << 2));
 			if (m == NULL) {

Modified: stable/7/sys/dev/bce/if_bce.c
==============================================================================
--- stable/7/sys/dev/bce/if_bce.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/bce/if_bce.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -6733,6 +6733,7 @@ bce_tso_setup(struct bce_softc *sc, stru
 		}
 
 		/* Get the TCP header length in bytes (min 20) */
+		ip = (struct ip *)(m->m_data + sizeof(struct ether_header));
 		th = (struct tcphdr *)((caddr_t)ip + ip_hlen);
 		tcp_hlen = (th->th_off << 2);
 
@@ -6745,6 +6746,7 @@ bce_tso_setup(struct bce_softc *sc, stru
 		}
 
 		/* IP header length and checksum will be calc'd by hardware */
+		ip = (struct ip *)(m->m_data + sizeof(struct ether_header));
 		ip_len = ip->ip_len;
 		ip->ip_len = 0;
 		ip->ip_sum = 0;

Modified: stable/7/sys/dev/bge/if_bge.c
==============================================================================
--- stable/7/sys/dev/bge/if_bge.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/bge/if_bge.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -3835,9 +3835,11 @@ bge_setup_tso(struct bge_softc *sc, stru
 	 * checksum. These checksum computed by upper stack should be 0.
 	 */
 	*mss = m->m_pkthdr.tso_segsz;
+	ip = (struct ip *)(mtod(m, char *) + sizeof(struct ether_header));
 	ip->ip_sum = 0;
 	ip->ip_len = htons(*mss + (ip->ip_hl << 2) + (tcp->th_off << 2));
 	/* Clear pseudo checksum computed by TCP stack. */
+	tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 	tcp->th_sum = 0;
 	/*
 	 * Broadcom controllers uses different descriptor format for

Modified: stable/7/sys/dev/fxp/if_fxp.c
==============================================================================
--- stable/7/sys/dev/fxp/if_fxp.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/fxp/if_fxp.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -1455,6 +1455,8 @@ fxp_encap(struct fxp_softc *sc, struct m
 		 * Since 82550/82551 doesn't modify IP length and pseudo
 		 * checksum in the first frame driver should compute it.
 		 */
+		ip = (struct ip *)(mtod(m, char *) + ip_off);
+		tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 		ip->ip_sum = 0;
 		ip->ip_len = htons(m->m_pkthdr.tso_segsz + (ip->ip_hl << 2) +
 		    (tcp->th_off << 2));

Modified: stable/7/sys/dev/jme/if_jme.c
==============================================================================
--- stable/7/sys/dev/jme/if_jme.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/jme/if_jme.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -1665,11 +1665,12 @@ jme_encap(struct jme_softc *sc, struct m
 			*m_head = NULL;
 			return (ENOBUFS);
 		}
-		tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 		/*
 		 * Reset IP checksum and recompute TCP pseudo
 		 * checksum that NDIS specification requires.
 		 */
+		ip = (struct ip *)(mtod(m, char *) + ip_off);
+		tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 		ip->ip_sum = 0;
 		if (poff + (tcp->th_off << 2) == m->m_pkthdr.len) {
 			tcp->th_sum = in_pseudo(ip->ip_src.s_addr,

Modified: stable/7/sys/dev/sge/if_sge.c
==============================================================================
--- stable/7/sys/dev/sge/if_sge.c	Sun Oct 24 21:14:01 2010	(r214295)
+++ stable/7/sys/dev/sge/if_sge.c	Sun Oct 24 21:17:23 2010	(r214296)
@@ -1457,7 +1457,9 @@ sge_encap(struct sge_softc *sc, struct m
 		 * Reset IP checksum and recompute TCP pseudo
 		 * checksum that NDIS specification requires.
 		 */
+		ip = (struct ip *)(mtod(m, char *) + ip_off);
 		ip->ip_sum = 0;
+		tcp = (struct tcphdr *)(mtod(m, char *) + poff);
 		tcp->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
 		    htons(IPPROTO_TCP));
 		*m_head = m;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201010242117.o9OLHN40040321>