Re: CVS commit: src/sys/dev/usb

[Takahiro HAYASHI <t.hash425%gmail.com@localhost>]

(06/13/14 11:53), I wrote:
> hi,
>
> sometimes rxhdr may be extracted from bogus pointer when receiving multiple
> pkts and size of 1st pkt is odd.
> Found by netstat increasing ierror.

ugh, I've forgotten resizing total_len.
I tried to hexdump buf, it seems that total_len includes length of
padding and ETHER_ALIGN but pktlen does not.


Index: src/sys/dev/usb/if_smsc.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/if_smsc.c,v
retrieving revision 1.16
diff -u -p -r1.16 if_smsc.c
--- src/sys/dev/usb/if_smsc.c   9 Jun 2014 15:50:55 -0000       1.16
+++ src/sys/dev/usb/if_smsc.c   13 Jun 2014 09:46:46 -0000
@@ -1288,6 +1288,10 @@ smsc_rxeof(usbd_xfer_handle xfer, usbd_p
                        goto done;
                }
 
+		/* The frame header is always aligned on a 4 byte boundary */
+               total_len -= (4 - (((ulong)(buf)) & 0x3)) & 0x3;
+               buf = (u_char *)((((ulong)(buf)) + 0x3) & ~0x3);
+
                memcpy(&rxhdr, buf, sizeof(rxhdr));
                rxhdr = le32toh(rxhdr);
                buf += sizeof(rxhdr);

--
t-hash