Date: Mon, 31 Jan 2011 12:17:07 -0500 From: John Baldwin <jhb@freebsd.org> To: net@freebsd.org Subject: Bogus KASSERT() in tcp_output()? Message-ID: <201101311217.07073.jhb@freebsd.org>
next in thread | raw e-mail | index | archive | help
Somewhat related fallout to the bug reported on security@ recently, I think this KASSERT() in tcp_output() is bogus: KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL), ("%s: mbuf chain shorter than expected", __func__)); Specifically, just a few lines earlier in tcp_output() we set the packet header length to just 'len + hdrlen': /* * Put TCP length in extended header, and then * checksum extended header and data. */ m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */ Also, the ipoptions are stored in a separate mbuf chain in the in pcb (inp_options) that is passed as a separate argument to ip_output(). Given that, I would think that m_length() should not reflect ipoptlen since it should not include IP options in that chain? -- John Baldwin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201101311217.07073.jhb>