Print this page
9560 IPv4 packets in IPv6 ethernet frames panic debug builds
Reviewed by: Jorge Schrauwen <jorge@blackdot.be>

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/io/mac/mac_sched.c
          +++ new/usr/src/uts/common/io/mac/mac_sched.c
↓ open down ↓ 1781 lines elided ↑ open up ↑
1782 1782          if (v6) {
1783 1783                  remlen = ntohs(ip6h->ip6_plen);
1784 1784                  nexthdr = ip6h->ip6_nxt;
1785 1785                  src_val = V4_PART_OF_V6(ip6h->ip6_src);
1786 1786                  dst_val = V4_PART_OF_V6(ip6h->ip6_dst);
1787 1787                  /*
1788 1788                   * Do src based fanout if below tunable is set to B_TRUE or
1789 1789                   * when mac_ip_hdr_length_v6() fails because of malformed
1790 1790                   * packets or because mblks need to be concatenated using
1791 1791                   * pullupmsg().
     1792 +                 *
     1793 +                 * Perform a version check to prevent parsing weirdness...
1792 1794                   */
1793      -                if (!mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr,
     1795 +                if (IPH_HDR_VERSION(ip6h) != IPV6_VERSION ||
     1796 +                    !mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr,
1794 1797                      NULL)) {
1795 1798                          goto src_dst_based_fanout;
1796 1799                  }
1797 1800          } else {
1798 1801                  hdr_len = IPH_HDR_LENGTH(ipha);
1799 1802                  remlen = ntohs(ipha->ipha_length) - hdr_len;
1800 1803                  nexthdr = ipha->ipha_protocol;
1801 1804                  src_val = (uint32_t)ipha->ipha_src;
1802 1805                  dst_val = (uint32_t)ipha->ipha_dst;
1803 1806                  /*
↓ open down ↓ 3188 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX