diff options
| author | Mike Karels <karels@FreeBSD.org> | 2022-05-09 12:19:52 +0000 |
|---|---|---|
| committer | Mike Karels <karels@FreeBSD.org> | 2022-05-09 13:46:06 +0000 |
| commit | 1de9aa4d4f7938f36e6485dad817908a6e45bb32 (patch) | |
| tree | f4336d5832027f838e01e023909f1fbdf1863fa5 | |
| parent | dc484aed0a014de0fdf33d972c36413da6903a2e (diff) | |
| download | src-1de9aa4d4f7938f36e6485dad817908a6e45bb32.tar.gz src-1de9aa4d4f7938f36e6485dad817908a6e45bb32.zip | |
genet: fix output packet corruption in uncommon case
The code for the "shift" block in the COPY macro set the pointer for
the next copy block to the wrong value. In this case, the link-layer
header would be overwritten by the network-layer header. This case is
difficult or impossible to exercise in the current driver without
changing the value of the hw.genet.tx_hdr_min sysctl. Correct the
pointer. While here, remove a line in the macro that was marked
"unneeded", which was actually wrong.
PR: 263824
Submitted by: jiahali@blackberry.com
MFC after: 2 weeks
| -rw-r--r-- | sys/arm64/broadcom/genet/if_genet.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/sys/arm64/broadcom/genet/if_genet.c b/sys/arm64/broadcom/genet/if_genet.c index 47ff3a484387..3e22f387bf61 100644 --- a/sys/arm64/broadcom/genet/if_genet.c +++ b/sys/arm64/broadcom/genet/if_genet.c @@ -1254,11 +1254,10 @@ gen_parse_tx(struct mbuf *m, int csum_flags) m0->m_data = m0->m_pktdat; \ bcopy(p0, mtodo(m0, sizeof(struct statusblock)),\ m0->m_len - sizeof(struct statusblock)); \ - copy_p = mtodo(m0, sizeof(struct statusblock)); \ + copy_p = mtodo(m0, m0->m_len); \ } \ bcopy(p, copy_p, hsize); \ m0->m_len += hsize; \ - m0->m_pkthdr.len += hsize; /* unneeded */ \ m->m_len -= hsize; \ m->m_data += hsize; \ } \ |