Date: Tue, 03 Sep 2019 14:06:27 -0000 From: "Jason A. Harmening" <jah@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r346019 - stable/12/sys/compat/freebsd32 Message-ID: <201904071902.x37J2Xmv017584@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jah Date: Sun Apr 7 19:02:33 2019 New Revision: 346019 URL: https://svnweb.freebsd.org/changeset/base/346019 Log: MFC r345741: freebsd32: fix padding of computed control message length for recvmsg() Each control message region must be aligned on a 4-byte boundary on 32-bit architectures. The 32-bit compat shim for recvmsg() gets the actual layout right, but doesn't pad the payload length when computing msg_controllen for the output message header. If a control message contains an unaligned payload, such as the 1-byte TTL field in the example attached to PR 236737, this can produce control message payload boundaries that extend beyond the boundary reported by msg_controllen. PR: 236737 Modified: stable/12/sys/compat/freebsd32/freebsd32_misc.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/compat/freebsd32/freebsd32_misc.c ============================================================================== --- stable/12/sys/compat/freebsd32/freebsd32_misc.c Sun Apr 7 18:39:55 2019 (r346018) +++ stable/12/sys/compat/freebsd32/freebsd32_misc.c Sun Apr 7 19:02:33 2019 (r346019) @@ -1183,8 +1183,8 @@ freebsd32_copy_msg_out(struct msghdr *msg, struct mbuf cm = NULL; } - msg->msg_controllen += FREEBSD32_ALIGN(sizeof(*cm)) + - datalen_out; + msg->msg_controllen += + FREEBSD32_CMSG_SPACE(datalen_out); } } if (len == 0 && m != NULL) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201904071902.x37J2Xmv017584>