Date: Mon, 28 Mar 2011 16:58:48 +0000 (UTC) From: Pyun YongHyeon <yongari@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r220103 - head/sys/dev/fxp Message-ID: <201103281658.p2SGwmOv000485@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: yongari Date: Mon Mar 28 16:58:48 2011 New Revision: 220103 URL: http://svn.freebsd.org/changeset/base/220103 Log: Normally fxp(4) does not receive bad frames but promiscuous mode makes controller to receive bad frames and i82557 will also receive bad frames since fxp(4) have to receive VLAN oversized frames. If fxp(4) encounter DMA overrun error, the received frame size would be 0 so the actual frame size after checksum field extraction the length would be negative(-2). Due to signed/unsigned comparison used in driver, frame length check did not work for DMA overrun frames. Correct this by casting it to int. While I'm here explicitly check DMA overrun error and discard the frame regardless of result of received frame length check. Reported by: n_hibma Tested by: n_hibma MFC after: 1 week Modified: head/sys/dev/fxp/if_fxp.c Modified: head/sys/dev/fxp/if_fxp.c ============================================================================== --- head/sys/dev/fxp/if_fxp.c Mon Mar 28 13:28:23 2011 (r220102) +++ head/sys/dev/fxp/if_fxp.c Mon Mar 28 16:58:48 2011 (r220103) @@ -1941,11 +1941,11 @@ fxp_intr_body(struct fxp_softc *sc, stru /* Adjust for appended checksum bytes. */ total_len -= 2; } - if (total_len < sizeof(struct ether_header) || + if (total_len < (int)sizeof(struct ether_header) || total_len > (MCLBYTES - RFA_ALIGNMENT_FUDGE - sc->rfa_size) || status & (FXP_RFA_STATUS_CRC | - FXP_RFA_STATUS_ALIGN)) { + FXP_RFA_STATUS_ALIGN | FXP_RFA_STATUS_OVERRUN)) { m_freem(m); fxp_add_rfabuf(sc, rxp); continue;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201103281658.p2SGwmOv000485>