diff options
| author | gallatin <gallatin@FreeBSD.org> | 2006-10-17 14:39:19 +0000 |
|---|---|---|
| committer | gallatin <gallatin@FreeBSD.org> | 2006-10-17 14:39:19 +0000 |
| commit | 5e3b1e8a37b3b7c4cab982175252e5613e339696 (patch) | |
| tree | 6a9ea555adee6499b1586957f7bb897a301c3d62 /sys/dev/mxge | |
| parent | aa770141457691fd53764698ded55d6c2c181fc6 (diff) | |
| download | FreeBSD-src-5e3b1e8a37b3b7c4cab982175252e5613e339696.zip FreeBSD-src-5e3b1e8a37b3b7c4cab982175252e5613e339696.tar.gz | |
Fix a driver bug which could result in frames MHLEN or (MHLEN - 1) bytes
long being DMA'ed 2 (or 1) bytes past the end of the mbuf and corrupting
random kernel memory. I had forgotten about the 2 bytes of implict
padding the firmware assumes.
Sponsored by: Myricom Inc.
Diffstat (limited to 'sys/dev/mxge')
| -rw-r--r-- | sys/dev/mxge/if_mxge.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/mxge/if_mxge.c b/sys/dev/mxge/if_mxge.c index 4e2b154..f1ad5b3 100644 --- a/sys/dev/mxge/if_mxge.c +++ b/sys/dev/mxge/if_mxge.c @@ -1930,7 +1930,7 @@ mxge_clean_rx_done(mxge_softc_t *sc) length = ntohs(rx_done->entry[rx_done->idx].length); rx_done->entry[rx_done->idx].length = 0; checksum = ntohs(rx_done->entry[rx_done->idx].checksum); - if (length <= MHLEN) + if (length <= (MHLEN - MXGEFW_PAD)) mxge_rx_done_small(sc, length, checksum); else mxge_rx_done_big(sc, length, checksum); @@ -2429,7 +2429,7 @@ mxge_open(mxge_softc_t *sc) of two. Luckily, FreeBSD's clusters are powers of two */ cmd.data0 = sc->ifp->if_mtu + ETHER_HDR_LEN; err = mxge_send_cmd(sc, MXGEFW_CMD_SET_MTU, &cmd); - cmd.data0 = MHLEN; + cmd.data0 = MHLEN - MXGEFW_PAD; err |= mxge_send_cmd(sc, MXGEFW_CMD_SET_SMALL_BUFFER_SIZE, &cmd); cmd.data0 = sc->big_bytes; |
