Author: jah
Date: Sun Apr 7 19:02:33 2019
New Revision: 346019
URL: https://svnweb.freebsd.org/changeset/base/346019
Log:
MFC r345741:
freebsd32: fix padding of computed control message length for recvmsg()
Each control message region must be aligned on a 4-byte boundary on 32-bit
architectures. The 32-bit compat shim for recvmsg() gets the actual layout
right, but doesn't pad the payload length when computing msg_controllen for
the output message header. If a control message contains an unaligned
payload, such as the 1-byte TTL field in the example attached to PR 236737,
this can produce control message payload boundaries that extend beyond
the boundary reported by msg_controllen.
PR: 236737
Modified:
stable/12/sys/compat/freebsd32/freebsd32_misc.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/compat/freebsd32/freebsd32_misc.c
==============================================================================
--- stable/12/sys/compat/freebsd32/freebsd32_misc.c Sun Apr 7 18:39:55
2019 (r346018)
+++ stable/12/sys/compat/freebsd32/freebsd32_misc.c Sun Apr 7 19:02:33
2019 (r346019)
@@ -1183,8 +1183,8 @@ freebsd32_copy_msg_out(struct msghdr *msg, struct mbuf
cm = NULL;
}
- msg->msg_controllen += FREEBSD32_ALIGN(sizeof(*cm)) +
- datalen_out;
+ msg->msg_controllen +=
+ FREEBSD32_CMSG_SPACE(datalen_out);
}
}
if (len == 0 && m != NULL) {
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
