From owner-svn-src-all@FreeBSD.ORG  Wed Oct 15 19:24:18 2008
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9122B10656A0;
	Wed, 15 Oct 2008 19:24:18 +0000 (UTC) (envelope-from bz@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 7FA518FC1D;
	Wed, 15 Oct 2008 19:24:18 +0000 (UTC) (envelope-from bz@FreeBSD.org)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id m9FJOIep041310;
	Wed, 15 Oct 2008 19:24:18 GMT (envelope-from bz@svn.freebsd.org)
Received: (from bz@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id m9FJOIlW041309;
	Wed, 15 Oct 2008 19:24:18 GMT (envelope-from bz@svn.freebsd.org)
Message-Id: <200810151924.m9FJOIlW041309@svn.freebsd.org>
From: "Bjoern A. Zeeb" <bz@FreeBSD.org>
Date: Wed, 15 Oct 2008 19:24:18 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r183923 - head/sys/netinet6
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Oct 2008 19:24:18 -0000

Author: bz
Date: Wed Oct 15 19:24:18 2008
New Revision: 183923
URL: http://svn.freebsd.org/changeset/base/183923

Log:
  Check that the mbuf len is positive (like we do in the v4 case).
  
  Read the other way round this means that even with the checks
  the m_len turned negative in some cases which led to panics.
  The reason to my understanding seems to be that the checks are wrong
  (also for v4) ignoring possible padding when checking cmsg_len or
  padding after data when adjusting the mbuf.
  Doing proper cheks seems to break applications like named so
  further investigation and regression tests are needed.
  
  PR:		kern/119123
  Tested by:	Ashish Shukla  wahjava gmail.com
  MFC after:	3 days

Modified:
  head/sys/netinet6/ip6_output.c

Modified: head/sys/netinet6/ip6_output.c
==============================================================================
--- head/sys/netinet6/ip6_output.c	Wed Oct 15 16:58:35 2008	(r183922)
+++ head/sys/netinet6/ip6_output.c	Wed Oct 15 19:24:18 2008	(r183923)
@@ -2820,7 +2820,7 @@ ip6_setpktopts(struct mbuf *control, str
 	if (control->m_next)
 		return (EINVAL);
 
-	for (; control->m_len; control->m_data += CMSG_ALIGN(cm->cmsg_len),
+	for (; control->m_len > 0; control->m_data += CMSG_ALIGN(cm->cmsg_len),
 	    control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
 		int error;