Module Name: src Committed By: bouyer Date: Tue Jun 16 10:34:49 UTC 2020
Modified Files: src/sys/dev/usb [netbsd-7]: if_run.c Log Message: Pull up following revision(s) (requested by martin in ticket #1735): sys/dev/usb/if_run.c: revision 1.41 Better bounds checking for oversized packets, to avoid kernel memory corruption. Pointed out by Ilja Van Sprundel. To generate a diff of this commit: cvs rdiff -u -r1.10.4.4 -r1.10.4.5 src/sys/dev/usb/if_run.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/usb/if_run.c diff -u src/sys/dev/usb/if_run.c:1.10.4.4 src/sys/dev/usb/if_run.c:1.10.4.5 --- src/sys/dev/usb/if_run.c:1.10.4.4 Wed Aug 8 10:17:11 2018 +++ src/sys/dev/usb/if_run.c Tue Jun 16 10:34:49 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_run.c,v 1.10.4.4 2018/08/08 10:17:11 martin Exp $ */ +/* $NetBSD: if_run.c,v 1.10.4.5 2020/06/16 10:34:49 bouyer Exp $ */ /* $OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $ */ /*- @@ -23,7 +23,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.10.4.4 2018/08/08 10:17:11 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.10.4.5 2020/06/16 10:34:49 bouyer Exp $"); #ifdef _KERNEL_OPT #include "opt_usb.h" @@ -2067,7 +2067,8 @@ run_rx_frame(struct run_softc *sc, uint8 return; } if (len > MHLEN) { - MCLGET(m, M_DONTWAIT); + if (__predict_true(len <= MCLBYTES)) + MCLGET(m, M_DONTWAIT); if (__predict_false(!(m->m_flags & M_EXT))) { ifp->if_ierrors++; m_freem(m);