diff options
| author | Cathy Zhou <Cathy.Zhou@Sun.COM> | 2009-02-25 13:11:34 -0800 |
|---|---|---|
| committer | Cathy Zhou <Cathy.Zhou@Sun.COM> | 2009-02-25 13:11:34 -0800 |
| commit | b53ab68f29007cf9b7aa9b93883a0a35750986a4 (patch) | |
| tree | 8dd6be80b4cb9a3da960d9f6fc72ec4396409542 /usr/src | |
| parent | 9a6f360e750e0b14fc9b9bf8347e0ebad3959e3f (diff) | |
| download | illumos-joyent-b53ab68f29007cf9b7aa9b93883a0a35750986a4.tar.gz | |
6801906 Batoka panics with link-aggregation
6802625 potentially access invalid memory in i_dld_ether_header_update_tag()
Diffstat (limited to 'usr/src')
| -rw-r--r-- | usr/src/uts/common/io/dld/dld_str.c | 37 |
1 files changed, 20 insertions, 17 deletions
diff --git a/usr/src/uts/common/io/dld/dld_str.c b/usr/src/uts/common/io/dld/dld_str.c index e05ce5b1c1..f7f4266062 100644 --- a/usr/src/uts/common/io/dld/dld_str.c +++ b/usr/src/uts/common/io/dld/dld_str.c @@ -333,25 +333,28 @@ dld_wput(queue_t *wq, mblk_t *mp) switch (DB_TYPE(mp)) { case M_DATA: mutex_enter(&dsp->ds_lock); - if (dsp->ds_dlstate == DL_IDLE) { - mode = dsp->ds_mode; - if (mode == DLD_FASTPATH || mode == DLD_RAW) { - DLD_DATATHR_INC(dsp); - mutex_exit(&dsp->ds_lock); - if (mode == DLD_FASTPATH) { - (void) str_mdata_fastpath_put(dsp, mp, - 0, 0); - } else { - str_mdata_raw_put(dsp, mp); - } - DLD_DATATHR_DCR(dsp); - break; - } + mode = dsp->ds_mode; + if ((dsp->ds_dlstate != DL_IDLE) || + (mode != DLD_FASTPATH && mode != DLD_RAW)) { + mutex_exit(&dsp->ds_lock); + freemsg(mp); + break; } + + DLD_DATATHR_INC(dsp); mutex_exit(&dsp->ds_lock); - freemsg(mp); + if (mode == DLD_FASTPATH) { + if (dsp->ds_mip->mi_media == DL_ETHER && + (MBLKL(mp) < sizeof (struct ether_header))) { + freemsg(mp); + } else { + (void) str_mdata_fastpath_put(dsp, mp, 0, 0); + } + } else { + str_mdata_raw_put(dsp, mp); + } + DLD_DATATHR_DCR(dsp); break; - case M_PROTO: case M_PCPROTO: { t_uscalar_t prim; @@ -711,7 +714,6 @@ i_dld_ether_header_update_tag(mblk_t *mp, uint_t pri, uint16_t vid, /* * Tagged packet, update the priority bits. */ - old_tci = ntohs(evhp->ether_tci); len = sizeof (struct ether_vlan_header); if ((DB_REF(mp) > 1) || (MBLKL(mp) < len)) { @@ -731,6 +733,7 @@ i_dld_ether_header_update_tag(mblk_t *mp, uint_t pri, uint16_t vid, } evhp = (struct ether_vlan_header *)mp->b_rptr; + old_tci = ntohs(evhp->ether_tci); } else { /* * Untagged packet. Two factors will cause us to insert a |