From 09c7b1526f3bbad5bb6b3bd34bd5630b5b750375 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Wed, 20 Jun 2018 21:19:45 -0400 Subject: [PATCH] freebsd11_network: Fix MLEN/MHLEN macros after mbufq changes. In 02cb8503d252cdb896ce01b0d1e436defdb45932, I added the m_next and m_nextpkt structures to mbuf, as per FreeBSD's mbufq system that FreeBSD 11.1's net80211 code uses. What I didn't realize (and korli and PulkoMandy who reviewed my code didn't notice either) is that the data fields in mbuf are sometimes dealt with through these LEN macros, which were now incorrect after such changes. This caused an out-of-bounds memory write for data above a certain size that was attempting to be written into an mbuf that under the old sizing would have been fine, but under this new sizing was invalid, and this manifested itself as a KDL under the guarded_heap (#14207). It possibly also manifested itself as a stack-smash with the new net80211 code (uncommitted on a local machine, and the reason I tried using the guarded heap in the first place.) Now we use FreeBSD 11's macros, which use offsetof instead of raw integer math. This means that we can't specify the struct size in mbuf as these structs are computed from mbuf's definition, and thus have to rely on the allocator giving mbuf the correct size (as FreeBSD does also.) --- src/libs/compat/freebsd11_network/compat/sys/mbuf.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/libs/compat/freebsd11_network/compat/sys/mbuf.h b/src/libs/compat/freebsd11_network/compat/sys/mbuf.h index 94670ffb73..18c9c76405 100644 --- a/src/libs/compat/freebsd11_network/compat/sys/mbuf.h +++ b/src/libs/compat/freebsd11_network/compat/sys/mbuf.h @@ -12,8 +12,10 @@ #include -#define MLEN ((int)(MSIZE - sizeof(struct m_hdr))) -#define MHLEN ((int)(MLEN - sizeof(struct pkthdr))) +#define MHSIZE __offsetof(struct mbuf, m_dat) +#define MPKTHSIZE __offsetof(struct mbuf, m_pktdat) +#define MLEN ((int)(MSIZE - MHSIZE)) +#define MHLEN ((int)(MSIZE - MPKTHSIZE)) #define MINCLSIZE (MHLEN + 1) @@ -137,10 +139,10 @@ struct mbuf { struct pkthdr MH_pkthdr; union { struct m_ext MH_ext; - char MH_databuf[MHLEN]; + char MH_databuf[0]; } MH_dat; } MH; - char M_databuf[MLEN]; + char M_databuf[0]; } M_dat; };