Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 7 Apr 2019 19:08:07 +0000 (UTC)
From:      "Jason A. Harmening" <jah@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r346020 - stable/11/sys/compat/freebsd32
Message-ID:  <201904071908.x37J87Hd017881@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: jah
Date: Sun Apr  7 19:08:07 2019
New Revision: 346020
URL: https://svnweb.freebsd.org/changeset/base/346020

Log:
  MFC r345741:
  
  freebsd32: fix padding of computed control message length for recvmsg()
  
  Each control message region must be aligned on a 4-byte boundary on 32-bit
  architectures. The 32-bit compat shim for recvmsg() gets the actual layout
  right, but doesn't pad the payload length when computing msg_controllen for
  the output message header. If a control message contains an unaligned
  payload, such as the 1-byte TTL field in the example attached to PR 236737,
  this can produce control message payload boundaries that extend beyond
  the boundary reported by msg_controllen.
  
  PR:	236737

Modified:
  stable/11/sys/compat/freebsd32/freebsd32_misc.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/11/sys/compat/freebsd32/freebsd32_misc.c	Sun Apr  7 19:02:33 2019	(r346019)
+++ stable/11/sys/compat/freebsd32/freebsd32_misc.c	Sun Apr  7 19:08:07 2019	(r346020)
@@ -1035,8 +1035,8 @@ freebsd32_copy_msg_out(struct msghdr *msg, struct mbuf
 				cm = NULL;
 			}
 
-			msg->msg_controllen += FREEBSD32_ALIGN(sizeof(*cm)) +
-			    datalen_out;
+			msg->msg_controllen +=
+			    FREEBSD32_CMSG_SPACE(datalen_out);
 		}
 	}
 	if (len == 0 && m != NULL) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201904071908.x37J87Hd017881>