DragonFlyBSD Kernel Audit
DF-1381 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/netif/vge/if_vge.c b/sys/dev/netif/vge/if_vge.c
--- a/sys/dev/netif/vge/if_vge.c
+++ b/sys/dev/netif/vge/if_vge.c
@@ -1160,7 +1160,15 @@
 #define VGE_RXCHUNK 4
 	sc->vge_rx_consumed++;
 	if (sc->vge_rx_consumed == VGE_RXCHUNK) {
-		for (i = idx; i != idx - sc->vge_rx_consumed; i--) {
+		int j;
+		/*
+		 * Set the OWN bit on the last VGE_RXCHUNK descriptors ending at
+		 * idx, wrapping modularly around the ring. The original signed
+		 * 'i != idx - consumed' loop underflowed to negative indices when
+		 * idx < VGE_RXCHUNK, writing before the DMA allocation (DF-1381).
+		 */
+		for (i = idx, j = 0; j < VGE_RXCHUNK; j++,
+		    i = (i - 1 + VGE_RX_DESC_CNT) % VGE_RX_DESC_CNT) {
 			sc->vge_ldata.vge_rx_list[i].vge_sts |=
 			    htole32(VGE_RDSTS_OWN);
 		}