Module Name: src
Committed By: martin
Date: Thu Jun 11 09:56:57 UTC 2020
Modified Files:
src/sys/dev/usb: if_run.c
Log Message:
Better bounds checking for oversized packets, to avoid kernel memory
corruption. Pointed out by Ilja Van Sprundel.
To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 src/sys/dev/usb/if_run.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/if_run.c
diff -u src/sys/dev/usb/if_run.c:1.40 src/sys/dev/usb/if_run.c:1.41
--- src/sys/dev/usb/if_run.c:1.40 Sat Jun 6 13:53:43 2020
+++ src/sys/dev/usb/if_run.c Thu Jun 11 09:56:57 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: if_run.c,v 1.40 2020/06/06 13:53:43 gson Exp $ */
+/* $NetBSD: if_run.c,v 1.41 2020/06/11 09:56:57 martin Exp $ */
/* $OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $ */
/*-
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.40 2020/06/06 13:53:43 gson Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.41 2020/06/11 09:56:57 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -2345,7 +2345,8 @@ run_rx_frame(struct run_softc *sc, uint8
return;
}
if (len > MHLEN) {
- MCLGET(m, M_DONTWAIT);
+ if (__predict_true(len <= MCLBYTES))
+ MCLGET(m, M_DONTWAIT);
if (__predict_false(!(m->m_flags & M_EXT))) {
if_statinc(ifp, if_ierrors);
m_freem(m);
