d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix problem reported by Matt Dillon. Occasionally, very small received

Browse Source 
frames would be handled incorrectly due to bad usage of m_pullup() in
the case where the frame wraps from the end of the receive buffer back
the beginning.

Also, when manually extending small packets to pad them to the minimum
frame length during transmission, zero out the pad area to make some
really paranoid people happy.
This commit is contained in:
Bill Paul 1999-12-23 19:05:58 +00:00
parent 7dfb2a9760
commit 9d378ed009
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/pci/if_rl.c
View File

@ -1130,7 +1130,12 @@ static void rl_rxeof(sc)
m_adj(m, RL_ETHER_ALIGN);
m_copyback(m, wrap, total_len - wrap,
sc->rl_cdata.rl_rx_buf);
m = m_pullup(m, MHLEN - RL_ETHER_ALIGN);
m = m_pullup(m, sizeof(struct ether_header));
if (m == NULL) {
printf("rl%d: m_pullup failed",
sc->rl_unit);
ifp->if_ierrors++;
}
}
cur_rx = (total_len - wrap + ETHER_CRC_LEN);
} else {
@ -1345,6 +1350,14 @@ static int rl_encap(sc, m_head)
/* Pad frames to at least 60 bytes. */
if (m_head->m_pkthdr.len < RL_MIN_FRAMELEN) {
/*
* Make security concious people happy: zero out the
* bytes in the pad area, since we don't know what
* this mbuf cluster buffer's previous user might
* have left in it.
*/
bzero(mtod(m_head, char *) + m_head->m_pkthdr.len,
RL_MIN_FRAMELEN - m_head->m_pkthdr.len);
m_head->m_pkthdr.len +=
(RL_MIN_FRAMELEN - m_head->m_pkthdr.len);
m_head->m_len = m_head->m_pkthdr.len;