Module Name: src Committed By: knakahara Date: Mon Dec 11 02:17:35 UTC 2017
Modified Files: src/sys/netinet: in_l2tp.c src/sys/netinet6: in6_l2tp.c Log Message: fix pullup'ed mbuf leaks. pointed out by maxv@n.o, thanks. XXX need pullup-8 To generate a diff of this commit: cvs rdiff -u -r1.4 -r1.5 src/sys/netinet/in_l2tp.c cvs rdiff -u -r1.7 -r1.8 src/sys/netinet6/in6_l2tp.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netinet/in_l2tp.c diff -u src/sys/netinet/in_l2tp.c:1.4 src/sys/netinet/in_l2tp.c:1.5 --- src/sys/netinet/in_l2tp.c:1.4 Wed Nov 15 10:42:41 2017 +++ src/sys/netinet/in_l2tp.c Mon Dec 11 02:17:35 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $ */ +/* $NetBSD: in_l2tp.c,v 1.5 2017/12/11 02:17:35 knakahara Exp $ */ /* * Copyright (c) 2017 Internet Initiative Japan Inc. @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $"); +__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.5 2017/12/11 02:17:35 knakahara Exp $"); #ifdef _KERNEL_OPT #include "opt_l2tp.h" @@ -368,13 +368,9 @@ in_l2tp_match(struct mbuf *m, int off, i KASSERT(proto == IPPROTO_L2TP); - if (m->m_len < off + sizeof(uint32_t)) { - m = m_pullup(m, off + sizeof(uint32_t)); - if (!m) { - /* if payload length < 4 octets */ - return 0; - } - } + /* if payload length < 4 octets */ + if (m->m_len < off + sizeof(uint32_t)) + return 0; /* get L2TP session ID */ m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id); Index: src/sys/netinet6/in6_l2tp.c diff -u src/sys/netinet6/in6_l2tp.c:1.7 src/sys/netinet6/in6_l2tp.c:1.8 --- src/sys/netinet6/in6_l2tp.c:1.7 Wed Nov 15 10:42:41 2017 +++ src/sys/netinet6/in6_l2tp.c Mon Dec 11 02:17:35 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: in6_l2tp.c,v 1.7 2017/11/15 10:42:41 knakahara Exp $ */ +/* $NetBSD: in6_l2tp.c,v 1.8 2017/12/11 02:17:35 knakahara Exp $ */ /* * Copyright (c) 2017 Internet Initiative Japan Inc. @@ -27,7 +27,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.7 2017/11/15 10:42:41 knakahara Exp $"); +__KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.8 2017/12/11 02:17:35 knakahara Exp $"); #ifdef _KERNEL_OPT #include "opt_l2tp.h" @@ -360,13 +360,9 @@ in6_l2tp_match(struct mbuf *m, int off, KASSERT(proto == IPPROTO_L2TP); - if (m->m_len < off + sizeof(uint32_t)) { - m = m_pullup(m, off + sizeof(uint32_t)); - if (!m) { - /* if payload length < 4 octets */ - return 0; - } - } + /* if payload length < 4 octets */ + if (m->m_len < off + sizeof(uint32_t)) + return 0; /* get L2TP session ID */ m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);