DragonFlyBSD Kernel Audit
DF-1197 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/netif/emx/if_emx.c b/sys/dev/netif/emx/if_emx.c
--- a/sys/dev/netif/emx/if_emx.c
+++ b/sys/dev/netif/emx/if_emx.c
@@ -2915,7 +2915,17 @@
 	}
 	m->m_len = m->m_pkthdr.len = MCLBYTES;
 
-	if (rdata->sc->hw.mac.max_frame_size <= MCLBYTES - ETHER_ALIGN)
+	/*
+	 * Reserve ETHER_ALIGN bytes for IP-header alignment only when the
+	 * interface MTU is standard.  emx_init_rx_unit() sets RCTL_LPE as
+	 * soon as MTU > ETHERMTU, which permits the hardware to receive
+	 * frames larger than the post-m_adj buffer (MCLBYTES - ETHER_ALIGN
+	 * = 2046 bytes); with RCTL_SZ_2048 the first descriptor is then
+	 * DMA-filled with 2048 bytes, overflowing the 2046-byte mapping by
+	 * 2 bytes (DF-1197).  Applying ETHER_ALIGN only when LPE is also
+	 * off closes that window.
+	 */
+	if (rdata->sc->arpcom.ac_if.if_mtu <= ETHERMTU)
 		m_adj(m, ETHER_ALIGN);
 
 	error = bus_dmamap_load_mbuf_segment(rdata->rxtag,