diff options
| author | Andriy Voskoboinyk <avos@FreeBSD.org> | 2017-07-04 07:07:08 +0000 |
|---|---|---|
| committer | Andriy Voskoboinyk <avos@FreeBSD.org> | 2017-07-04 07:07:08 +0000 |
| commit | 373769715934eacb7dabc81e876659e2cd64e7ef (patch) | |
| tree | a65d3a73fee25cfc0c9a78fe1aec11f7c91d71dc /sys/dev/rtwn | |
| parent | 88156ba5816a5bd8afa46da05043fdeb3299ebc5 (diff) | |
| download | src-373769715934eacb7dabc81e876659e2cd64e7ef.tar.gz src-373769715934eacb7dabc81e876659e2cd64e7ef.zip | |
rtwn_usb: reject too long (>16K) mbufs.
While here move RTWN_TXBUFSZ constant from common to USB specific code
(it's not used anywhere else).
Notes
Notes:
svn path=/head/; revision=320640
Diffstat (limited to 'sys/dev/rtwn')
| -rw-r--r-- | sys/dev/rtwn/if_rtwnvar.h | 2 | ||||
| -rw-r--r-- | sys/dev/rtwn/usb/rtwn_usb_attach.c | 2 | ||||
| -rw-r--r-- | sys/dev/rtwn/usb/rtwn_usb_ep.c | 8 | ||||
| -rw-r--r-- | sys/dev/rtwn/usb/rtwn_usb_tx.c | 3 | ||||
| -rw-r--r-- | sys/dev/rtwn/usb/rtwn_usb_var.h | 2 |
5 files changed, 10 insertions, 7 deletions
diff --git a/sys/dev/rtwn/if_rtwnvar.h b/sys/dev/rtwn/if_rtwnvar.h index 18ae6b4c455e..40050c3b90a5 100644 --- a/sys/dev/rtwn/if_rtwnvar.h +++ b/sys/dev/rtwn/if_rtwnvar.h @@ -25,8 +25,6 @@ #define RTWN_TX_DESC_SIZE 64 -#define RTWN_TXBUFSZ (16 * 1024) - #define RTWN_BCN_MAX_SIZE 512 #define RTWN_CAM_ENTRY_LIMIT 64 diff --git a/sys/dev/rtwn/usb/rtwn_usb_attach.c b/sys/dev/rtwn/usb/rtwn_usb_attach.c index 6beed50ab357..959184e7f43a 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_attach.c +++ b/sys/dev/rtwn/usb/rtwn_usb_attach.c @@ -155,7 +155,7 @@ rtwn_usb_alloc_tx_list(struct rtwn_softc *sc) int error, i; error = rtwn_usb_alloc_list(sc, uc->uc_tx, RTWN_USB_TX_LIST_COUNT, - RTWN_TXBUFSZ); + RTWN_USB_TXBUFSZ); if (error != 0) return (error); diff --git a/sys/dev/rtwn/usb/rtwn_usb_ep.c b/sys/dev/rtwn/usb/rtwn_usb_ep.c index 52c628d5a9a7..596265d4d4cc 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_ep.c +++ b/sys/dev/rtwn/usb/rtwn_usb_ep.c @@ -73,7 +73,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = { .type = UE_BULK, .endpoint = UE_ADDR_ANY, .direction = UE_DIR_OUT, - .bufsize = RTWN_TXBUFSZ, + .bufsize = RTWN_USB_TXBUFSZ, .flags = { .ext_buffer = 1, .pipe_bof = 1, @@ -86,7 +86,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = { .type = UE_BULK, .endpoint = UE_ADDR_ANY, .direction = UE_DIR_OUT, - .bufsize = RTWN_TXBUFSZ, + .bufsize = RTWN_USB_TXBUFSZ, .flags = { .ext_buffer = 1, .pipe_bof = 1, @@ -99,7 +99,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = { .type = UE_BULK, .endpoint = UE_ADDR_ANY, .direction = UE_DIR_OUT, - .bufsize = RTWN_TXBUFSZ, + .bufsize = RTWN_USB_TXBUFSZ, .flags = { .ext_buffer = 1, .pipe_bof = 1, @@ -112,7 +112,7 @@ static const struct usb_config rtwn_config_common[RTWN_N_TRANSFER] = { .type = UE_BULK, .endpoint = UE_ADDR_ANY, .direction = UE_DIR_OUT, - .bufsize = RTWN_TXBUFSZ, + .bufsize = RTWN_USB_TXBUFSZ, .flags = { .ext_buffer = 1, .pipe_bof = 1, diff --git a/sys/dev/rtwn/usb/rtwn_usb_tx.c b/sys/dev/rtwn/usb/rtwn_usb_tx.c index c30e9e746985..2c5d55d3a56b 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_tx.c +++ b/sys/dev/rtwn/usb/rtwn_usb_tx.c @@ -233,6 +233,9 @@ rtwn_usb_tx_start(struct rtwn_softc *sc, struct ieee80211_node *ni, RTWN_ASSERT_LOCKED(sc); + if (m->m_pkthdr.len + sc->txdesc_len > RTWN_USB_TXBUFSZ) + return (EINVAL); + data = rtwn_usb_getbuf(uc); if (data == NULL) return (ENOBUFS); diff --git a/sys/dev/rtwn/usb/rtwn_usb_var.h b/sys/dev/rtwn/usb/rtwn_usb_var.h index be7f8f198834..aa0f987b7730 100644 --- a/sys/dev/rtwn/usb/rtwn_usb_var.h +++ b/sys/dev/rtwn/usb/rtwn_usb_var.h @@ -21,6 +21,8 @@ #ifndef RTWN_USBVAR_H #define RTWN_USBVAR_H +#define RTWN_USB_TXBUFSZ (16 * 1024) + #define RTWN_IFACE_INDEX 0 #define RTWN_USB_RX_LIST_COUNT 1 |