Make sure that the entire header is in the first mbuf before we

attempt to copy the ethernet header forward and otherwise encapsulate
a packet for output.

This fixes the panic when using VLAN devices on hardware that doesn't
do 802.1Q tagging onboard.  (That is to say, all drivers except the Tigon.)

My tests consisted of telnet, ttcp, and a pingflood of packets
between 1 and 1600 (plus headers) bytes.

MFC to follow in 1 week.

Approved by:	jkh

1 files changed, 14 insertions, 2 deletions

diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index bb92b97..cefaa9d 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -193,7 +193,7 @@ vlan_start(struct ifnet *ifp)
 	struct ifvlan *ifv;
 	struct ifnet *p;
 	struct ether_vlan_header *evl;
-	struct mbuf *m;
+	struct mbuf *m, *m0;
 
 	ifv = ifp->if_softc;
 	p = ifv->ifv_p;
@@ -229,10 +229,22 @@ vlan_start(struct ifnet *ifp)
 			m->m_flags |= M_PROTO1;
 		} else {
 			M_PREPEND(m, EVL_ENCAPLEN, M_DONTWAIT);
-			if (m == 0)
+			if (m == NULL) {
+				printf("vlan%d: M_PREPEND failed", ifp->if_unit);
+				ifp->if_ierrors++;
 				continue;
+			}
 			/* M_PREPEND takes care of m_len, m_pkthdr.len for us */
 
+			m0 = m_pullup(m, ETHER_HDR_LEN + EVL_ENCAPLEN);
+			if (m0 == NULL) {
+				printf("vlan%d: m_pullup failed", ifp->if_unit);
+				ifp->if_ierrors++;
+				m_freem(m);
+				continue;
+			}
+			m = m0;
+
 			/*
 			 * Transform the Ethernet header into an Ethernet header
 			 * with 802.1Q encapsulation.