[src/netbsd-7]: src/sys/dev/usb Pull up following revision(s) (requested by m...

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/e28f23361a29
branches:  netbsd-7
changeset: 934692:e28f23361a29
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Tue Jun 16 10:34:49 2020 +0000

description:
Pull up following revision(s) (requested by martin in ticket #1735):
        sys/dev/usb/if_run.c: revision 1.41
Better bounds checking for oversized packets, to avoid kernel memory
corruption. Pointed out by Ilja Van Sprundel.

diffstat:

 sys/dev/usb/if_run.c |  7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diffs (28 lines):

diff -r f3c482fee084 -r e28f23361a29 sys/dev/usb/if_run.c
--- a/sys/dev/usb/if_run.c      Tue Jun 16 10:33:38 2020 +0000
+++ b/sys/dev/usb/if_run.c      Tue Jun 16 10:34:49 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_run.c,v 1.10.4.4 2018/08/08 10:17:11 martin Exp $   */
+/*     $NetBSD: if_run.c,v 1.10.4.5 2020/06/16 10:34:49 bouyer Exp $   */
 /*     $OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $ */
 
 /*-
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.10.4.4 2018/08/08 10:17:11 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.10.4.5 2020/06/16 10:34:49 bouyer Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -2067,7 +2067,8 @@
                return;
        }
        if (len > MHLEN) {
-               MCLGET(m, M_DONTWAIT);
+               if (__predict_true(len <= MCLBYTES))
+                       MCLGET(m, M_DONTWAIT);
                if (__predict_false(!(m->m_flags & M_EXT))) {
                        ifp->if_ierrors++;
                        m_freem(m);