Date: Fri, 31 Aug 2018 08:37:15 +0000 (UTC) From: Kristof Provost <kp@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r338406 - head/sys/netinet6 Message-ID: <201808310837.w7V8bFsF044014@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kp Date: Fri Aug 31 08:37:15 2018 New Revision: 338406 URL: https://svnweb.freebsd.org/changeset/base/338406 Log: frag6: Fix fragment reassembly r337776 started hashing the fragments into buckets for faster lookup. The hashkey is larger than intended. This results in random stack data being included in the hashed data, which in turn means that fragments of the same packet might end up in different buckets, causing the reassembly to fail. Set the correct size for hashkey. PR: 231045 Approved by: re (kib) MFC after: 3 days Modified: head/sys/netinet6/frag6.c Modified: head/sys/netinet6/frag6.c ============================================================================== --- head/sys/netinet6/frag6.c Fri Aug 31 05:21:33 2018 (r338405) +++ head/sys/netinet6/frag6.c Fri Aug 31 08:37:15 2018 (r338406) @@ -218,7 +218,9 @@ frag6_input(struct mbuf **mp, int *offp, int proto) int offset = *offp, nxt, i, next; int first_frag = 0; int fragoff, frgpartlen; /* must be larger than u_int16_t */ - uint32_t hash, hashkey[sizeof(struct in6_addr) * 2 + 1], *hashkeyp; + uint32_t hashkey[(sizeof(struct in6_addr) * 2 + + sizeof(ip6f->ip6f_ident)) / sizeof(uint32_t)]; + uint32_t hash, *hashkeyp; struct ifnet *dstifp; u_int8_t ecn, ecn0; #ifdef RSS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201808310837.w7V8bFsF044014>