Module Name: src Committed By: bouyer Date: Tue Jun 16 10:28:29 UTC 2020
Modified Files: src/sys/dev/usb [netbsd-8]: if_run.c Log Message: Pull up following revision(s) (requested by martin in ticket #1559): sys/dev/usb/if_run.c: revision 1.41 Better bounds checking for oversized packets, to avoid kernel memory corruption. Pointed out by Ilja Van Sprundel. To generate a diff of this commit: cvs rdiff -u -r1.22.2.2 -r1.22.2.3 src/sys/dev/usb/if_run.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/usb/if_run.c diff -u src/sys/dev/usb/if_run.c:1.22.2.2 src/sys/dev/usb/if_run.c:1.22.2.3 --- src/sys/dev/usb/if_run.c:1.22.2.2 Wed Aug 8 10:28:35 2018 +++ src/sys/dev/usb/if_run.c Tue Jun 16 10:28:29 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_run.c,v 1.22.2.2 2018/08/08 10:28:35 martin Exp $ */ +/* $NetBSD: if_run.c,v 1.22.2.3 2020/06/16 10:28:29 bouyer Exp $ */ /* $OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $ */ /*- @@ -23,7 +23,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.22.2.2 2018/08/08 10:28:35 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.22.2.3 2020/06/16 10:28:29 bouyer Exp $"); #ifdef _KERNEL_OPT #include "opt_usb.h" @@ -2255,7 +2255,8 @@ run_rx_frame(struct run_softc *sc, uint8 return; } if (len > MHLEN) { - MCLGET(m, M_DONTWAIT); + if (__predict_true(len <= MCLBYTES)) + MCLGET(m, M_DONTWAIT); if (__predict_false(!(m->m_flags & M_EXT))) { ifp->if_ierrors++; m_freem(m);