Re: CVS commit: src/sys/dev/usb

[Takahiro HAYASHI <t.hash425%gmail.com@localhost>]

hi,

sometimes rxhdr may be extracted from bogus pointer when receiving multiple
pkts and size of 1st pkt is odd.
Found by netstat increasing ierror.

> Jun 13 09:10:35 rpi /netbsd: debug: xfer status total_len 513
> Jun 13 09:10:35 rpi /netbsd: debug: rxeof total_len 509 pktlen 247 rxhdr 
> 0x00f72420
> Jun 13 09:10:35 rpi /netbsd: debug: rxeof total_len 256 pktlen 10837 rxhdr 
> 0xaa5501dc
> Jun 13 09:10:35 rpi /netbsd: debug: pktlen 10839 > total_len 256

Try this patch. (From FreeBSD src/sys/dev/usb/net/if_smsc.c)
But something tells me this is not enough to fix.

Index: src/sys/dev/usb/if_smsc.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/if_smsc.c,v
retrieving revision 1.16
diff -u -p -r1.16 if_smsc.c
--- src/sys/dev/usb/if_smsc.c   9 Jun 2014 15:50:55 -0000       1.16
+++ src/sys/dev/usb/if_smsc.c   13 Jun 2014 02:19:07 -0000
@@ -1288,6 +1288,9 @@ smsc_rxeof(usbd_xfer_handle xfer, usbd_p
                        goto done;
                }
 
+		/* The frame header is always aligned on a 4 byte boundary */
+               buf = (u_char *)((((ulong)(buf)) + 0x3) & ~0x3);
+
                memcpy(&rxhdr, buf, sizeof(rxhdr));
                rxhdr = le32toh(rxhdr);
                buf += sizeof(rxhdr);

--
t-hash