⬢ DragonFlyBSD Kernel Audit
DF-2357 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/u4b/wlan/if_rum.c
+++ b/sys/bus/u4b/wlan/if_rum.c
@@ -1054,10 +1054,16 @@
 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
 			m = data->m;
 
-			if (m->m_pkthdr.len > (int)(MCLBYTES + RT2573_TX_DESC_SIZE)) {
+			/*
+			 * The frame must fit into the TX DMA buffer after
+			 * the TX descriptor:
+			 * bufsize - RT2573_TX_DESC_SIZE = MCLBYTES + 8.
+			 */
+			if (m->m_pkthdr.len > (int)(MCLBYTES + 8)) {
 				DPRINTFN(0, "data overflow, %u bytes\n",
 				    m->m_pkthdr.len);
-				m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);
+				rum_tx_free(data, 1);
+				goto tr_setup;
 			}
 			pc = usbd_xfer_get_frame(xfer, 0);
 			usbd_copy_in(pc, 0, &data->desc, RT2573_TX_DESC_SIZE);