d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix for unaligned IP-header.

Browse Source 
The mbuf length fields must be set before m_adj() is called else
m_adj() will not always adjust the mbuf and an unaligned read
exception can trigger inside the network stack. This can happen on
platforms where unaligned reads are not supported. Adjust a length
check to include the 2-byte ethernet alignment while at it.

MFC after:	3 days
This commit is contained in:
Hans Petter Selasky 2015-11-06 12:54:27 +00:00
parent 72c33534b2
commit a51f980180
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/dev/usb/net/if_cdce.c
View File

@ -1535,6 +1535,7 @@ cdce_ncm_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
/* check if we have a buffer */
if (m) {
m->m_len = m->m_pkthdr.len = temp + ETHER_ALIGN;
m_adj(m, ETHER_ALIGN);
usbd_copy_out(pc, offset, m->m_data, temp);

3
sys/dev/usb/net/if_urndis.c
View File

@ -884,7 +884,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
DPRINTF("invalid ethernet size "
"%u < %u\n", msg.rm_datalen, (unsigned)sizeof(struct ether_header));
goto tr_setup;
} else if (msg.rm_datalen > (uint32_t)MCLBYTES) {
} else if (msg.rm_datalen > (uint32_t)(MCLBYTES - ETHER_ALIGN)) {
if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
DPRINTF("invalid ethernet size "
"%u > %u\n",
@ -898,6 +898,7 @@ urndis_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
/* check if we have a buffer */
if (m != NULL) {
m->m_len = m->m_pkthdr.len = msg.rm_datalen + ETHER_ALIGN;
m_adj(m, ETHER_ALIGN);
usbd_copy_out(pc, offset + msg.rm_dataoffset +