rtems/rtems-libbsd
1
0
Fork 0
mirror of https://git.rtems.org/rtems-libbsd/ synced 2025-05-14 19:52:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

if_dwc: Avoid mbuf use after free

Browse Source
This commit is contained in:
Sebastian Huber 2015-04-07 13:54:23 +02:00
parent b99c023a08
commit 051b634730
1 changed files with 25 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
freebsd/sys/dev/dwc/if_dwc.c
View File

@ -806,13 +806,37 @@ dwc_rxfinish_locked(struct dwc_softc *sc)
if ((rdes0 & DDESC_RDES0_OWN) != 0)
break;
sc->rx_idx = next_rxidx(sc, idx);
m = sc->rxbuf_map[idx].mbuf;
m0 = dwc_alloc_mbufcl(sc);
if (m0 == NULL) {
m0 = m;
/* Account for m_adj() in dwc_setup_rxbuf() */
m0->m_data = m0->m_ext.ext_buf;
}
if ((error = dwc_setup_rxbuf(sc, idx, m0)) != 0) {
/*
* XXX Now what?
* We've got a hole in the rx ring.
*/
}
if (m0 == m) {
/* Discard frame and continue */
if_inc_counter(sc->ifp, IFCOUNTER_IQDROPS, 1);
continue;
}
bus_dmamap_sync(sc->rxbuf_tag, sc->rxbuf_map[idx].map,
BUS_DMASYNC_POSTREAD);
bus_dmamap_unload(sc->rxbuf_tag, sc->rxbuf_map[idx].map);
len = (rdes0 >> DDESC_RDES0_FL_SHIFT) & DDESC_RDES0_FL_MASK;
if (len != 0) {
m = sc->rxbuf_map[idx].mbuf;
m->m_pkthdr.rcvif = ifp;
m->m_pkthdr.len = len;
m->m_len = len;
@ -851,18 +875,6 @@ dwc_rxfinish_locked(struct dwc_softc *sc)
} else {
/* XXX Zero-length packet ? */
}
if ((m0 = dwc_alloc_mbufcl(sc)) != NULL) {
if ((error = dwc_setup_rxbuf(sc, idx, m0)) != 0) {
/*
* XXX Now what?
* We've got a hole in the rx ring.
*/
}
} else
if_inc_counter(sc->ifp, IFCOUNTER_IQDROPS, 1);
sc->rx_idx = next_rxidx(sc, sc->rx_idx);
}
}