Mercurial > unleashed > wips
changeset 19568:b30f212a345b
9560 IPv4 packets in IPv6 ethernet frames panic debug builds
Reviewed by: Jorge Schrauwen <jorge@blackdot.be>
Reviewed by: Igor Kozhukhov <igor@dilos.org>
Reviewed by: Toomas Soome <tsoome@me.com>
Reviewed by: Ken Mays <maybird1776@yahoo.com>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>
| author | Dan McDonald <danmcd@joyent.com> |
|---|---|
| date | Tue, 29 May 2018 15:55:43 -0400 |
| parents | 6e06c8f39f4b |
| children | c3b712717f7c |
| files | usr/src/uts/common/io/mac/mac_sched.c |
| diffstat | 1 files changed, 4 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/usr/src/uts/common/io/mac/mac_sched.c Thu May 24 20:13:04 2018 +0200 +++ b/usr/src/uts/common/io/mac/mac_sched.c Tue May 29 15:55:43 2018 -0400 @@ -1789,8 +1789,11 @@ * when mac_ip_hdr_length_v6() fails because of malformed * packets or because mblks need to be concatenated using * pullupmsg(). + * + * Perform a version check to prevent parsing weirdness... */ - if (!mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr, + if (IPH_HDR_VERSION(ip6h) != IPV6_VERSION || + !mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr, NULL)) { goto src_dst_based_fanout; }