Re: Panic: UDP header not in one mbuf
:I am not sure if this is the proper mailing list for this question; if
:not, please direct me accordingly.
:
:On a DragonFly 1.1-Current machine (cvsupped and built 8/19/2004) I
:receive the following output after a panic (with DDB enabled in kernel):
:
:panic: UDP header not in one mbuf
:...
:
:I have been having issues of this nature for a while - I suspect an
:issue I am having with bind (named) crashing is related to this.
:
:The machines are Supermicro 6013P-8 with dual P4 (Xeon) procs. ACPI is
:disabled, HTT is not. The machines process a decent volume (65k pieces
:daily) of email and use mimedefang/spamassassin/sendmail along with a
:local caching instance of named.
Sven, please try this patch. After examining the code path I found
a hole where an embedded ip_len which is smaller then the actual
packet survives the length test in ip_demux(), which means it can hit
the assertion in udp_input().
-Matt
Index: ip_demux.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_demux.c,v
retrieving revision 1.26
diff -u -r1.26 ip_demux.c
--- ip_demux.c 3 Aug 2004 00:04:13 -0000 1.26
+++ ip_demux.c 23 Aug 2004 21:21:14 -0000
@@ -109,6 +109,7 @@
{
struct ip *ip;
int iphlen;
+ int iplen;
struct tcphdr *th;
struct udphdr *uh;
struct mbuf *m = *mptr;
@@ -142,6 +143,7 @@
* first mbuf must entirely contain the extended IP header.
*/
iphlen = ip->ip_hl << 2;
+ iplen = ntohs(ip->ip_len);
if (iphlen < sizeof(struct ip)) { /* minimum header length */
ipstat.ips_badhlen++;
m_freem(m);
@@ -161,10 +163,20 @@
* The TCP/IP or UDP/IP header must be entirely contained within
* the first fragment of a packet. Packet filters will break if they
* aren't.
+ *
+ * Since the packet will be trimmed to ip_len we must also make sure
+ * the potentially trimmed down length is still sufficient to hold
+ * the header(s).
*/
if ((ntohs(ip->ip_off) & IP_OFFMASK) == 0) {
switch (ip->ip_p) {
case IPPROTO_TCP:
+ if (iplen < iphlen + sizeof(struct tcphdr)) {
+ ++tcpstat.tcps_rcvshort;
+ m_freem(m);
+ *mptr = NULL;
+ return (NULL);
+ }
if (m->m_len < iphlen + sizeof(struct tcphdr)) {
m = m_pullup(m, iphlen + sizeof(struct tcphdr));
if (m == NULL) {
@@ -176,6 +188,12 @@
}
break;
case IPPROTO_UDP:
+ if (iplen < iphlen + sizeof(struct udphdr)) {
+ ++udpstat.udps_hdrops;
+ m_freem(m);
+ *mptr = NULL;
+ return (NULL);
+ }
if (m->m_len < iphlen + sizeof(struct udphdr)) {
m = m_pullup(m, iphlen + sizeof(struct udphdr));
if (m == NULL) {
@@ -187,6 +205,12 @@
}
break;
default:
+ if (iplen < iphlen) {
+ ++ipstat.ips_badlen;
+ m_freem(m);
+ *mptr = NULL;
+ return (NULL);
+ }
break;
}
}
討論串 (同標題文章)
完整討論串 (本文為第 2 之 5 篇)：