Date: Tue, 01 Feb 2011 13:40:09 +1100 From: Lawrence Stewart <lstewart@freebsd.org> To: John Baldwin <jhb@freebsd.org> Cc: "Bjoern A. Zeeb" <bz@FreeBSD.org>, Andre Oppermann <andre@FreeBSD.ORG>, net@freebsd.org Subject: Re: Bogus KASSERT() in tcp_output()? Message-ID: <4D477289.8040901@freebsd.org> In-Reply-To: <201101311217.07073.jhb@freebsd.org> References: <201101311217.07073.jhb@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 02/01/11 04:17, John Baldwin wrote:
> Somewhat related fallout to the bug reported on security@ recently, I think
> this KASSERT() in tcp_output() is bogus:
>
>
> KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL),
> ("%s: mbuf chain shorter than expected", __func__));
>
> Specifically, just a few lines earlier in tcp_output() we set the packet
> header length to just 'len + hdrlen':
>
> /*
> * Put TCP length in extended header, and then
> * checksum extended header and data.
> */
> m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */
>
> Also, the ipoptions are stored in a separate mbuf chain in the in pcb
> (inp_options) that is passed as a separate argument to ip_output(). Given
> that, I would think that m_length() should not reflect ipoptlen since it
> should not include IP options in that chain?
>
There is some relevant prior discussion on src-committers@ for r212803
between Andre and Bjoern.
Cheers,
Lawrence
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4D477289.8040901>