diff options
| author | Hans Petter Selasky <hselasky@FreeBSD.org> | 2015-11-06 12:54:27 +0000 |
|---|---|---|
| committer | Hans Petter Selasky <hselasky@FreeBSD.org> | 2015-11-06 12:54:27 +0000 |
| commit | a51f9801806b43f453ead9a43d458f2d5ba541e6 (patch) | |
| tree | 1a19ac0e71f2c0171812343d83766fe070b11716 /sys/dev/usb/net/if_urndis.c | |
| parent | 72c33534b280e16bab55a48c8436a9f1b6b7203d (diff) | |
| download | src-a51f9801806b43f453ead9a43d458f2d5ba541e6.tar.gz src-a51f9801806b43f453ead9a43d458f2d5ba541e6.zip | |
Fix for unaligned IP-header.
The mbuf length fields must be set before m_adj() is called else
m_adj() will not always adjust the mbuf and an unaligned read
exception can trigger inside the network stack. This can happen on
platforms where unaligned reads are not supported. Adjust a length
check to include the 2-byte ethernet alignment while at it.
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=290441
Diffstat (limited to 'sys/dev/usb/net/if_urndis.c')
| -rw-r--r-- | sys/dev/usb/net/if_urndis.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/dev/usb/net/if_urndis.c b/sys/dev/usb/net/if_urndis.c index 3c24dcf1d4d7..32fa53370946 100644 --- a/sys/dev/usb/net/if_urndis.c +++ b/sys/dev/usb/net/if_urndis.c @@ -884,7 +884,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) DPRINTF("invalid ethernet size " "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header)); goto tr_setup; - } else if (msg.rm_datalen > (uint32_t)MCLBYTES) { + } else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) { if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); DPRINTF("invalid ethernet size " "%u > %u\n", @@ -898,6 +898,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) /* check if we have a buffer */ if (m != NULL) { + m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN; m_adj(m, ETHER_ALIGN); usbd_copy_out(pc, offset + msg.rm_dataoffset + |