git: 305b3ca5f40c - stable/12 - netgraph/ng_tag: permit variable length data
Lutz Donnerhacke
donner at FreeBSD.org
Mon Feb 1 13:58:06 UTC 2021
The branch stable/12 has been updated by donner:
URL: https://cgit.FreeBSD.org/src/commit/?id=305b3ca5f40cbfff1e29f7e2e10a636331a8575c
commit 305b3ca5f40cbfff1e29f7e2e10a636331a8575c
Author: Lutz Donnerhacke <lutz at donnerhacke.de>
AuthorDate: 2021-01-02 13:58:17 +0000
Commit: Lutz Donnerhacke <donner at FreeBSD.org>
CommitDate: 2021-02-01 13:55:42 +0000
netgraph/ng_tag: permit variable length data
ng_tag(4) operate on arbitrary data of mbuf_tags(9). Those structures
are padded to the next multiple of the alignment by the compiler.
Hence a valid argument has be at most as long as the data received.
PR: 241462
Reviewed by: kp
Approved by: philip (mentor)
Differential Revision: https://reviews.freebsd.org/D22140
(cherry picked from commit 7c7c231c14246a709270bf3f3a4593208e84d01a)
---
sys/netgraph/ng_tag.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/sys/netgraph/ng_tag.c b/sys/netgraph/ng_tag.c
index 9222d3bd3b20..bc3b39ec7f39 100644
--- a/sys/netgraph/ng_tag.c
+++ b/sys/netgraph/ng_tag.c
@@ -363,9 +363,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook)
hook_p hook;
/* Sanity check. */
- if (msg->header.arglen < sizeof(*hp)
- || msg->header.arglen !=
- NG_TAG_HOOKIN_SIZE(hp->tag_len))
+ if (msg->header.arglen < sizeof(*hp) ||
+ msg->header.arglen < NG_TAG_HOOKIN_SIZE(hp->tag_len))
ERROUT(EINVAL);
/* Find hook. */
@@ -385,9 +384,8 @@ ng_tag_rcvmsg(node_p node, item_p item, hook_p lasthook)
hook_p hook;
/* Sanity check. */
- if (msg->header.arglen < sizeof(*hp)
- || msg->header.arglen !=
- NG_TAG_HOOKOUT_SIZE(hp->tag_len))
+ if (msg->header.arglen < sizeof(*hp) ||
+ msg->header.arglen < NG_TAG_HOOKOUT_SIZE(hp->tag_len))
ERROUT(EINVAL);
/* Find hook. */
More information about the dev-commits-src-all
mailing list