From owner-svn-src-head@FreeBSD.ORG Fri Jan 31 22:42:27 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 612ABC9E; Fri, 31 Jan 2014 22:42:27 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4CFC81115; Fri, 31 Jan 2014 22:42:27 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id s0VMgRsm041017; Fri, 31 Jan 2014 22:42:27 GMT (envelope-from hselasky@svn.freebsd.org) Received: (from hselasky@localhost) by svn.freebsd.org (8.14.7/8.14.7/Submit) id s0VMgR9k041016; Fri, 31 Jan 2014 22:42:27 GMT (envelope-from hselasky@svn.freebsd.org) Message-Id: <201401312242.s0VMgR9k041016@svn.freebsd.org> From: Hans Petter Selasky Date: Fri, 31 Jan 2014 22:42:27 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r261330 - head/sys/dev/usb/wlan X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jan 2014 22:42:27 -0000 Author: hselasky Date: Fri Jan 31 22:42:26 2014 New Revision: 261330 URL: http://svnweb.freebsd.org/changeset/base/261330 Log: Fix a range check for maximum transmit length. The existing code was off by 4 bytes in one case. Approved by: kevlo @ MFC after: 2 weeks Modified: head/sys/dev/usb/wlan/if_run.c Modified: head/sys/dev/usb/wlan/if_run.c ============================================================================== --- head/sys/dev/usb/wlan/if_run.c Fri Jan 31 20:52:08 2014 (r261329) +++ head/sys/dev/usb/wlan/if_run.c Fri Jan 31 22:42:26 2014 (r261330) @@ -3070,10 +3070,10 @@ tr_setup: STAILQ_REMOVE_HEAD(&pq->tx_qh, next); m = data->m; - size = (sc->mac_ver == 0x5592) ? - RUN_MAX_TXSZ + sizeof(uint32_t) : RUN_MAX_TXSZ; + size = (sc->mac_ver == 0x5592) ? + sizeof(data->desc) + sizeof(uint32_t) : sizeof(data->desc); if ((m->m_pkthdr.len + - sizeof(data->desc) + 3 + 8) > size) { + size + 3 + 8) > RUN_MAX_TXSZ) { DPRINTF("data overflow, %u bytes\n", m->m_pkthdr.len); @@ -3085,8 +3085,6 @@ tr_setup: } pc = usbd_xfer_get_frame(xfer, 0); - size = (sc->mac_ver == 0x5592) ? - sizeof(data->desc) + sizeof(uint32_t) : sizeof(data->desc); usbd_copy_in(pc, 0, &data->desc, size); usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len); size += m->m_pkthdr.len;