kern/62989: ether_input computes incorrect m_pkthdr.len when mbufs are chained

[Roselyn Lee]

>Number:         62989
>Category:       kern
>Synopsis:       ether_input computes incorrect m_pkthdr.len when mbufs are chained
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Feb 17 18:40:30 PST 2004
>Closed-Date:
>Last-Modified:
>Originator:     Roselyn Lee
>Release:        4.8
>Organization:
Vernier Networks
>Environment:
4.8-RELEASE FreeBSD
>Description:
      m_pkthdr.len that is computed by ether_input() incorrectly assumes m_len is the length of the entire packet.  For example, the sis0 driver could return a list of mbufs to hold an incoming packet when the system is out of clusters.
>How-To-Repeat:
      
>Fix:
      void
ether_input(struct ifnet *ifp, struct ether_header *eh, struct mbuf *m)
{
	struct ether_header save_eh;

	if (eh == NULL) {
		if (m->m_len < sizeof(struct ether_header)) {
			/* XXX error in the caller. */
			m_freem(m);
			return;
		}
		m->m_pkthdr.rcvif = ifp;
		eh = mtod(m, struct ether_header *);
		m->m_data += sizeof(struct ether_header);
		m->m_len -= sizeof(struct ether_header);
-		m->m_pkthdr.len = m->m_len;
+               /*
+                * Adjust m_pkthdr.len by the same amount -
+                * do not assume m_pkthdr.len == m_len     
+                */
+               m->m_pkthdr.len -= sizeof (struct ether_header);
	}
>Release-Note:
>Audit-Trail:
>Unformatted: