Author: jah Date: Sat Mar 30 23:43:58 2019 New Revision: 345741 URL: https://svnweb.freebsd.org/changeset/base/345741
Log: freebsd32: fix padding of computed control message length for recvmsg() Each control message region must be aligned on a 4-byte boundary on 32-bit architectures. The 32-bit compat shim for recvmsg() gets the actual layout right, but doesn't pad the payload length when computing msg_controllen for the output message header. If a control message contains an unaligned payload, such as the 1-byte TTL field in the example attached to PR 236737, this can produce control message payload boundaries that extend beyond the boundary reported by msg_controllen. PR: 236737 Reported by: Yuval Pavel Zholkover <paulz...@gmail.com> Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D19768 Modified: head/sys/compat/freebsd32/freebsd32_misc.c Modified: head/sys/compat/freebsd32/freebsd32_misc.c ============================================================================== --- head/sys/compat/freebsd32/freebsd32_misc.c Sat Mar 30 21:04:08 2019 (r345740) +++ head/sys/compat/freebsd32/freebsd32_misc.c Sat Mar 30 23:43:58 2019 (r345741) @@ -1160,8 +1160,8 @@ freebsd32_copy_msg_out(struct msghdr *msg, struct mbuf cm = NULL; } - msg->msg_controllen += FREEBSD32_ALIGN(sizeof(*cm)) + - datalen_out; + msg->msg_controllen += + FREEBSD32_CMSG_SPACE(datalen_out); } } if (len == 0 && m != NULL) { _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
