Module Name: src
Committed By: kiyohara
Date: Sat Nov 28 12:16:57 UTC 2009
Modified Files:
src/sys/dev/ic: lan9118.c
Log Message:
Check mbuf size and buffers.
To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 src/sys/dev/ic/lan9118.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ic/lan9118.c
diff -u src/sys/dev/ic/lan9118.c:1.3 src/sys/dev/ic/lan9118.c:1.4
--- src/sys/dev/ic/lan9118.c:1.3 Sat Nov 28 08:44:00 2009
+++ src/sys/dev/ic/lan9118.c Sat Nov 28 12:16:57 2009
@@ -1,4 +1,4 @@
-/* $NetBSD: lan9118.c,v 1.3 2009/11/28 08:44:00 kiyohara Exp $ */
+/* $NetBSD: lan9118.c,v 1.4 2009/11/28 12:16:57 kiyohara Exp $ */
/*
* Copyright (c) 2008 KIYOHARA Takashi
* All rights reserved.
@@ -25,7 +25,7 @@
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: lan9118.c,v 1.3 2009/11/28 08:44:00 kiyohara Exp $");
+__KERNEL_RCSID(0, "$NetBSD: lan9118.c,v 1.4 2009/11/28 12:16:57 kiyohara Exp $");
/*
* The LAN9118 Family
@@ -360,6 +360,7 @@
unsigned tdfree, totlen, dso;
uint32_t txa, txb;
uint8_t *p;
+ int n;
DPRINTFN(3, ("%s\n", __func__));
@@ -389,6 +390,33 @@
* WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET.
*/
+ /*
+ * Check mbuf chain -- "middle" buffers must be >= 4 bytes
+ * and maximum # of buffers is 86.
+ */
+ m = m0;
+ n = 0;
+ while (m) {
+ if (m->m_len < 4 || ++n > 86) {
+ /* Copy mbuf chain. */
+ MGETHDR(m, M_DONTWAIT, MT_DATA);
+ if (m == NULL)
+ goto discard; /* discard packet */
+ MCLGET(m, M_DONTWAIT);
+ if ((m->m_flags & M_EXT) == 0) {
+ m_freem(m);
+ goto discard; /* discard packet */
+ }
+ m_copydata(m0, 0, m0->m_pkthdr.len,
+ mtod(m, void *));
+ m->m_pkthdr.len = m->m_len = m0->m_pkthdr.len;
+ m_freem(m0);
+ m0 = m;
+ break;
+ }
+ m = m->m_next;
+ }
+
m = m0;
totlen = m->m_pkthdr.len;
p = mtod(m, uint8_t *);
@@ -404,11 +432,6 @@
LAN9118_TXDFIFOP, txa);
bus_space_write_4(sc->sc_iot, sc->sc_ioh,
LAN9118_TXDFIFOP, txb);
- /*
- * XXXX:
- * We are assuming that the size of mbus always align
- * in 4 bytes.
- */
bus_space_write_multi_4(sc->sc_iot, sc->sc_ioh,
LAN9118_TXDFIFOP, (uint32_t *)(p - dso),
(m->m_len + dso + 3) >> 2);
@@ -428,6 +451,8 @@
bus_space_write_multi_4(sc->sc_iot, sc->sc_ioh,
LAN9118_TXDFIFOP, (uint32_t *)(p - dso),
(m->m_len + dso + 3) >> 2);
+
+discard:
#if NBPFILTER > 0
/*
* Pass the packet to any BPF listeners.
