mirror of
https://github.com/opnsense/src.git
synced 2026-06-28 01:45:56 -04:00
40ad87e958
uether_rxmbuf() assumes the uether_newbuf() model where the caller has
just set m_len to the entire size of the mbuf, and passed the final
size into uether_rxmbuf() for finalization.
In if_ure we're creating our own mbuf chains, and the accounting is all
already accurate. uether_rxmbuf's logic won't work at all for a chain,
so let's add an assertion to that effect (but I think the other callers
were all OK).
This fixes a panic on my Windows DevKit when undergoing any kind of
network stress that surfaces after the bogus mbuf is injected into the
network stack (usually observed in `m_dup`).
markj and I had spent some time investigating it and decided there's
some kind of buffer underrun happening; the rx packet descriptor reports
a length longer than what's actually available. We discard the rest of
the transfer, but then we end up fetching it in a subsequent transfer
and end up casting packet data to a `struct ure_rxpkt` incorrectly. It
would be better to fix the underlying root cause, but this is a
reasonable mitigation in the interim.
Reviewed by: markj
Fixes:
|
||
|---|---|---|
| .. | ||
| if_aue.c | ||
| if_auereg.h | ||
| if_axe.c | ||
| if_axereg.h | ||
| if_axge.c | ||
| if_axgereg.h | ||
| if_cdce.c | ||
| if_cdceem.c | ||
| if_cdcereg.h | ||
| if_cue.c | ||
| if_cuereg.h | ||
| if_ipheth.c | ||
| if_iphethvar.h | ||
| if_kue.c | ||
| if_kuefw.h | ||
| if_kuereg.h | ||
| if_mos.c | ||
| if_mosreg.h | ||
| if_muge.c | ||
| if_mugereg.h | ||
| if_rue.c | ||
| if_ruereg.h | ||
| if_smsc.c | ||
| if_smscreg.h | ||
| if_udav.c | ||
| if_udavreg.h | ||
| if_umb.c | ||
| if_umbreg.h | ||
| if_ure.c | ||
| if_urereg.h | ||
| if_urndis.c | ||
| if_urndisreg.h | ||
| if_usie.c | ||
| if_usievar.h | ||
| mbim.h | ||
| ruephy.c | ||
| ruephyreg.h | ||
| uhso.c | ||
| usb_ethernet.c | ||
| usb_ethernet.h | ||