Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 9 Nov 2015 11:27:31 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject:   svn commit: r290608 - stable/9/sys/dev/usb/net
Message-ID:  <201511091127.tA9BRVSu052430@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: hselasky
Date: Mon Nov  9 11:27:31 2015
New Revision: 290608
URL: https://svnweb.freebsd.org/changeset/base/290608

Log:
  MFC r290441:
  Fix for unaligned IP-header.
  
  The mbuf length fields must be set before m_adj() is called else
  m_adj() will not always adjust the mbuf and an unaligned read
  exception can trigger inside the network stack. This can happen on
  platforms where unaligned reads are not supported. Adjust a length
  check to include the 2-byte ethernet alignment while at it.

Modified:
  stable/9/sys/dev/usb/net/if_cdce.c
  stable/9/sys/dev/usb/net/if_urndis.c
Directory Properties:
  stable/9/sys/   (props changed)
  stable/9/sys/dev/   (props changed)

Modified: stable/9/sys/dev/usb/net/if_cdce.c
==============================================================================
--- stable/9/sys/dev/usb/net/if_cdce.c	Mon Nov  9 11:24:59 2015	(r290607)
+++ stable/9/sys/dev/usb/net/if_cdce.c	Mon Nov  9 11:27:31 2015	(r290608)
@@ -1381,6 +1381,7 @@ cdce_ncm_bulk_read_callback(struct usb_x
 
 			/* check if we have a buffer */
 			if (m) {
+				m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
 				m_adj(m, ETHER_ALIGN);
 
 				usbd_copy_out(pc, offset, m->m_data, temp);

Modified: stable/9/sys/dev/usb/net/if_urndis.c
==============================================================================
--- stable/9/sys/dev/usb/net/if_urndis.c	Mon Nov  9 11:24:59 2015	(r290607)
+++ stable/9/sys/dev/usb/net/if_urndis.c	Mon Nov  9 11:27:31 2015	(r290608)
@@ -848,7 +848,7 @@ urndis_bulk_read_callback(struct usb_xfe
 				DPRINTF("invalid ethernet size "
 				    "%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
 				goto tr_setup;
-			} else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
+			} else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
 				ifp->if_ierrors++;
 				DPRINTF("invalid ethernet size "
 				    "%u > %u\n",
@@ -862,6 +862,7 @@ urndis_bulk_read_callback(struct usb_xfe
 
 			/* check if we have a buffer */
 			if (m != NULL) {
+				m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
 				m_adj(m, ETHER_ALIGN);
 
 				usbd_copy_out(pc, offset + msg.rm_dataoffset +

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201511091127.tA9BRVSu052430>