CVS commit: [netbsd-8] src/sys/dev/usb

[Manuel Bouyer]

Module Name:    src
Committed By:   bouyer
Date:           Tue Jun 16 10:28:29 UTC 2020

Modified Files:
        src/sys/dev/usb [netbsd-8]: if_run.c

Log Message:
Pull up following revision(s) (requested by martin in ticket #1559):
        sys/dev/usb/if_run.c: revision 1.41
Better bounds checking for oversized packets, to avoid kernel memory
corruption. Pointed out by Ilja Van Sprundel.


To generate a diff of this commit:
cvs rdiff -u -r1.22.2.2 -r1.22.2.3 src/sys/dev/usb/if_run.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/usb/if_run.c
diff -u src/sys/dev/usb/if_run.c:1.22.2.2 src/sys/dev/usb/if_run.c:1.22.2.3
--- src/sys/dev/usb/if_run.c:1.22.2.2	Wed Aug  8 10:28:35 2018
+++ src/sys/dev/usb/if_run.c	Tue Jun 16 10:28:29 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_run.c,v 1.22.2.2 2018/08/08 10:28:35 martin Exp $	*/
+/*	$NetBSD: if_run.c,v 1.22.2.3 2020/06/16 10:28:29 bouyer Exp $	*/
 /*	$OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $	*/
 
 /*-
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.22.2.2 2018/08/08 10:28:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.22.2.3 2020/06/16 10:28:29 bouyer Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -2255,7 +2255,8 @@ run_rx_frame(struct run_softc *sc, uint8
 		return;
 	}
 	if (len > MHLEN) {
-		MCLGET(m, M_DONTWAIT);
+		if (__predict_true(len <= MCLBYTES))
+			MCLGET(m, M_DONTWAIT);
 		if (__predict_false(!(m->m_flags & M_EXT))) {
 			ifp->if_ierrors++;
 			m_freem(m);