CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/11/02 19:43:59
Modified files:
sys/dev/usb : if_rum.c
Log message:
Reject receive transfers whose descriptor frame length exceeds the data
actually transferred. The descriptor carries a 12-bit frame length and
the chip accepts frames up to 4095 bytes, but a receive transfer only has
MCLBYTES minus the descriptor for frame data.
Trusting the descriptor produced an mbuf extending past its cluster.
A fragmented IPv4 datagram then carried it into m_cat(), where a default
kernel panics on a DIAGNOSTIC assertion.
Report and diff from Acts1631.
ok miod@ claudio@ kettenis@
