Bogus KASSERT() in tcp_output()?

[Lawrence Stewart]

On 02/01/11 04:17, John Baldwin wrote:
> Somewhat related fallout to the bug reported on security@ recently, I think 
> this KASSERT() in tcp_output() is bogus:
> 
> 
> 	KASSERT(len + hdrlen + ipoptlen == m_length(m, NULL),
> 	    ("%s: mbuf chain shorter than expected", __func__));
> 
> Specifically, just a few lines earlier in tcp_output() we set the packet 
> header length to just 'len + hdrlen':
> 
> 	/*
> 	 * Put TCP length in extended header, and then
> 	 * checksum extended header and data.
> 	 */
> 	m->m_pkthdr.len = hdrlen + len; /* in6_cksum() need this */
> 
> Also, the ipoptions are stored in a separate mbuf chain in the in pcb 
> (inp_options) that is passed as a separate argument to ip_output().  Given 
> that, I would think that m_length() should not reflect ipoptlen since it 
> should not include IP options in that chain?
> 

There is some relevant prior discussion on src-committers@ for r212803
between Andre and Bjoern.

Cheers,
Lawrence