⬢ DragonFlyBSD Kernel Audit
DF-3777 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/netif/jme/if_jme.c
+++ b/sys/dev/netif/jme/if_jme.c
@@ -2510,6 +2510,21 @@
 		 */
 		nsegs = JME_RX_NSEGS(le32toh(desc->buflen));
 		pktlen = JME_RX_BYTES(le32toh(desc->buflen));
+		if (nsegs < 1) {
+			/*
+			 * Degenerate descriptor (nsegs == 0 passes the
+			 * nsegs/howmany() consistency check below because
+			 * howmany(0, MCLBYTES) == 0).  jme_rxpkt() would
+			 * neither repost the descriptor nor advance
+			 * jme_rx_cons, leaving this loop spinning on the
+			 * same OWN-clear, VALID-set descriptor forever.
+			 * Repost it and move on.
+			 */
+			jme_discard_rxbufs(rdata, rdata->jme_rx_cons, 1);
+			JME_DESC_INC(rdata->jme_rx_cons,
+			    rdata->jme_rx_desc_cnt);
+			continue;
+		}
 		if (nsegs != howmany(pktlen, MCLBYTES)) {
 			if_printf(&rdata->jme_sc->arpcom.ac_if,
 			    "RX fragment count(%d) and "