Author: hselasky
Date: Mon Nov 9 11:24:59 2015
New Revision: 290607
URL: https://svnweb.freebsd.org/changeset/base/290607
Log:
MFC r290441:
Fix for unaligned IP-header.
The mbuf length fields must be set before m_adj() is called else
m_adj() will not always adjust the mbuf and an unaligned read
exception can trigger inside the network stack. This can happen on
platforms where unaligned reads are not supported. Adjust a length
check to include the 2-byte ethernet alignment while at it.
Modified:
stable/10/sys/dev/usb/net/if_cdce.c
stable/10/sys/dev/usb/net/if_urndis.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/dev/usb/net/if_cdce.c
==============================================================================
--- stable/10/sys/dev/usb/net/if_cdce.c Mon Nov 9 10:41:27 2015
(r290606)
+++ stable/10/sys/dev/usb/net/if_cdce.c Mon Nov 9 11:24:59 2015
(r290607)
@@ -1381,6 +1381,7 @@ cdce_ncm_bulk_read_callback(struct usb_x
/* check if we have a buffer */
if (m) {
+ m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
m_adj(m, ETHER_ALIGN);
usbd_copy_out(pc, offset, m->m_data, temp);
Modified: stable/10/sys/dev/usb/net/if_urndis.c
==============================================================================
--- stable/10/sys/dev/usb/net/if_urndis.c Mon Nov 9 10:41:27 2015
(r290606)
+++ stable/10/sys/dev/usb/net/if_urndis.c Mon Nov 9 11:24:59 2015
(r290607)
@@ -848,7 +848,7 @@ urndis_bulk_read_callback(struct usb_xfe
DPRINTF("invalid ethernet size "
"%u < %u\n", msg.rm_datalen,
(unsigned)sizeof(struct ether_header));
goto tr_setup;
- } else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
+ } else if (msg.rm_datalen > (uint32_t)(MCLBYTES -
ETHER_ALIGN)) {
ifp->if_ierrors++;
DPRINTF("invalid ethernet size "
"%u > %u\n",
@@ -862,6 +862,7 @@ urndis_bulk_read_callback(struct usb_xfe
/* check if we have a buffer */
if (m != NULL) {
+ m->m_len = m->m_pkthdr.len = msg.rm_datalen +
ETHER_ALIGN;
m_adj(m, ETHER_ALIGN);
usbd_copy_out(pc, offset + msg.rm_dataoffset +
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
