[src/trunk]: src/sys/dev/usb Better bounds checking for oversized packets, to...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7b368cbdcd6f
branches:  trunk
changeset: 1010882:7b368cbdcd6f
user:      martin <martin%NetBSD.org@localhost>
date:      Thu Jun 11 09:56:57 2020 +0000

description:
Better bounds checking for oversized packets, to avoid kernel memory
corruption. Pointed out by Ilja Van Sprundel.

diffstat:

 sys/dev/usb/if_run.c |  7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diffs (28 lines):

diff -r b425ea590270 -r 7b368cbdcd6f sys/dev/usb/if_run.c
--- a/sys/dev/usb/if_run.c      Thu Jun 11 09:51:37 2020 +0000
+++ b/sys/dev/usb/if_run.c      Thu Jun 11 09:56:57 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_run.c,v 1.40 2020/06/06 13:53:43 gson Exp $ */
+/*     $NetBSD: if_run.c,v 1.41 2020/06/11 09:56:57 martin Exp $       */
 /*     $OpenBSD: if_run.c,v 1.90 2012/03/24 15:11:04 jsg Exp $ */
 
 /*-
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.40 2020/06/06 13:53:43 gson Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_run.c,v 1.41 2020/06/11 09:56:57 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -2345,7 +2345,8 @@
                return;
        }
        if (len > MHLEN) {
-               MCLGET(m, M_DONTWAIT);
+               if (__predict_true(len <= MCLBYTES))
+                       MCLGET(m, M_DONTWAIT);
                if (__predict_false(!(m->m_flags & M_EXT))) {
                        if_statinc(ifp, if_ierrors);
                        m_freem(m);