diff options
| author |   stsp <stsp@openbsd.org> | 2019-08-29 07:49:15 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2019-08-29 07:49:15 +0000 |
| commit | 5bbf75670cd8354c74b206e2ec4f5643a1b8555e (patch) | |
| tree | c2074e2bb75b28ed41399ecc967f1e7a373a5462 | |
| parent | Don't write to mbuf length fields before mbuf is removed from iwm(4) Rx ring. (diff) | |
| download | wireguard-openbsd-5bbf75670cd8354c74b206e2ec4f5643a1b8555e.tar.xz wireguard-openbsd-5bbf75670cd8354c74b206e2ec4f5643a1b8555e.zip | |
fix iwm(4) frame length check to account for header in firmware rx packet
ok mpi@ procter@
| -rw-r--r-- | sys/dev/pci/if_iwm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/pci/if_iwm.c b/sys/dev/pci/if_iwm.c index 55c1586845c..42cb00c62cc 100644 --- a/sys/dev/pci/if_iwm.c +++ b/sys/dev/pci/if_iwm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_iwm.c,v 1.246 2019/08/29 07:48:45 stsp Exp $ */ +/* $OpenBSD: if_iwm.c,v 1.247 2019/08/29 07:49:15 stsp Exp $ */ /* * Copyright (c) 2014, 2016 genua gmbh <info@genua.de> @@ -3545,7 +3545,7 @@ iwm_rx_rx_mpdu(struct iwm_softc *sc, struct iwm_rx_packet *pkt, IC2IFP(ic)->if_ierrors++; return; } - if (len > IWM_RBUF_SIZE) { + if (len > IWM_RBUF_SIZE - sizeof(*rx_res)) { IC2IFP(ic)->if_ierrors++; return; } |