lcc.richard@locus.ucla.edu (Richard Mathews) (12/24/85)
Description:
If a packet includes tcp options, the m_len and m_off fields of
the mbuf are set incorrectly. I had this happen on a 4.1 system
with 4.2 ipc added, but a glance at the 4.3 code indicates that
the problem exists there as well.
Repeat-by:
Send packets with tcp options to a system running 4.2 or 4.3. We
had someone who ran the "mget" command from "ftp" and consistantly
got "panic: trap" in the bcopy called from sballoc. He was sending
files from a Gould to a Vax. Bcopy was passed a length of -8.
Fix:
In tcp_input(), change:
/*
* Drop TCP and IP headers.
*/
off += sizeof (struct ip);
m->m_off += off;
m->m_len -= off;
to:
/*
* Drop TCP and IP headers.
*/
m->m_off += sizeof(struct tcpiphdr);
m->m_len -= sizeof(struct tcpiphdr);
Notice that this only makes a difference if the test
if (off > sizeof (struct tcphdr))
was true.
Richard M. Mathews
Locus Computing Corporation lcc.richard@LOCUS.UCLA.EDU
lcc.richard@UCLA-CS
{ihnp4,ucivax,trwrb}!lcc!richard
{randvax,sdcrdcf,ucbvax,trwspp}!ucla-cs!lcc!richard