Date: Mon, 1 Feb 2021 14:08:07 GMT From: Lutz Donnerhacke <donner@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 90d158c0cf25 - stable/11 - netgraph/ng_tag: permit variable length data Message-ID: <202102011408.111E87k3004923@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/11 has been updated by donner: URL: https://cgit.FreeBSD.org/src/commit/?id=90d158c0cf2598fde2ea1c7cd58909cf5a21c471 commit 90d158c0cf2598fde2ea1c7cd58909cf5a21c471 Author: Lutz Donnerhacke <donner@FreeBSD.org> AuthorDate: 2021-01-02 13:58:17 +0000 Commit: Lutz Donnerhacke <donner@FreeBSD.org> CommitDate: 2021-02-01 14:07:31 +0000 netgraph/ng_tag: permit variable length data ng_tag(4) operate on arbitrary data of mbuf_tags(9). Those structures are padded to the next multiple of the alignment by the compiler. Hence a valid argument has be at most as long as the data received. PR: 241462 Reviewed by: kp Approved by: philip (mentor) Differential Revision: https://reviews.freebsd.org/D22140 (cherry picked from commit 7c7c231c14246a709270bf3f3a4593208e84d01a) --- sys/netgraph/ng_tag.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/sys/netgraph/ng_tag.c b/sys/netgraph/ng_tag.c index 22d45a3174ad..1a9d44528a24 100644 --- a/sys/netgraph/ng_tag.c +++ b/sys/netgraph/ng_tag.c @@ -361,9 +361,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook) hook_p hook; /* Sanity check. */ - if (msg->header.arglen < sizeof(*hp) - || msg->header.arglen != - NG_TAG_HOOKIN_SIZE(hp->tag_len)) + if (msg->header.arglen < sizeof(*hp) || + msg->header.arglen < NG_TAG_HOOKIN_SIZE(hp->tag_len)) ERROUT(EINVAL); /* Find hook. */ @@ -383,9 +382,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook) hook_p hook; /* Sanity check. */ - if (msg->header.arglen < sizeof(*hp) - || msg->header.arglen != - NG_TAG_HOOKOUT_SIZE(hp->tag_len)) + if (msg->header.arglen < sizeof(*hp) || + msg->header.arglen < NG_TAG_HOOKOUT_SIZE(hp->tag_len)) ERROUT(EINVAL); /* Find hook. */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202102011408.111E87k3004923>