svn commit: r345741 - head/sys/compat/freebsd32

[Jason A. Harmening]

Author: jah
Date: Sat Mar 30 23:43:58 2019
New Revision: 345741
URL: https://svnweb.freebsd.org/changeset/base/345741

Log:
  freebsd32: fix padding of computed control message length for recvmsg()
  
  Each control message region must be aligned on a 4-byte boundary on 32-bit
  architectures. The 32-bit compat shim for recvmsg() gets the actual layout
  right, but doesn't pad the payload length when computing msg_controllen for
  the output message header. If a control message contains an unaligned
  payload, such as the 1-byte TTL field in the example attached to PR 236737,
  this can produce control message payload boundaries that extend beyond
  the boundary reported by msg_controllen.
  
  PR:	236737
  Reported by:	Yuval Pavel Zholkover <paulzhol at gmail.com>
  Reviewed by:	markj
  MFC after:	1 week
  Differential Revision:	https://reviews.freebsd.org/D19768

Modified:
  head/sys/compat/freebsd32/freebsd32_misc.c

Modified: head/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- head/sys/compat/freebsd32/freebsd32_misc.c	Sat Mar 30 21:04:08 2019	(r345740)
+++ head/sys/compat/freebsd32/freebsd32_misc.c	Sat Mar 30 23:43:58 2019	(r345741)
@@ -1160,8 +1160,8 @@ freebsd32_copy_msg_out(struct msghdr *msg, struct mbuf
 				cm = NULL;
 			}
 
-			msg->msg_controllen += FREEBSD32_ALIGN(sizeof(*cm)) +
-			    datalen_out;
+			msg->msg_controllen +=
+			    FREEBSD32_CMSG_SPACE(datalen_out);
 		}
 	}
 	if (len == 0 && m != NULL) {