⬢ DragonFlyBSD Kernel Audit
DF-4066 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
--- a/sys/dev/netif/ti/if_ti.c
+++ b/sys/dev/netif/ti/if_ti.c
@@ -1645,6 +1645,10 @@
 
 		if (cur_rx->ti_flags & TI_BDFLAG_JUMBO_RING) {
 			TI_INC(sc->ti_jumbo, TI_JUMBO_RX_RING_CNT);
+			if (rxidx >= TI_JUMBO_RX_RING_CNT) {
+				IFNET_STAT_INC(ifp, ierrors, 1);
+				continue;
+			}
 			m = sc->ti_cdata.ti_rx_jumbo_chain[rxidx];
 			sc->ti_cdata.ti_rx_jumbo_chain[rxidx] = NULL;
 			if (cur_rx->ti_flags & TI_BDFLAG_ERROR) {
@@ -1659,6 +1663,10 @@
 			}
 		} else if (cur_rx->ti_flags & TI_BDFLAG_MINI_RING) {
 			TI_INC(sc->ti_mini, TI_MINI_RX_RING_CNT);
+			if (rxidx >= TI_MINI_RX_RING_CNT) {
+				IFNET_STAT_INC(ifp, ierrors, 1);
+				continue;
+			}
 			m = sc->ti_cdata.ti_rx_mini_chain[rxidx];
 			sc->ti_cdata.ti_rx_mini_chain[rxidx] = NULL;
 			if (cur_rx->ti_flags & TI_BDFLAG_ERROR) {
@@ -1673,6 +1681,10 @@
 			}
 		} else {
 			TI_INC(sc->ti_std, TI_STD_RX_RING_CNT);
+			if (rxidx >= TI_STD_RX_RING_CNT) {
+				IFNET_STAT_INC(ifp, ierrors, 1);
+				continue;
+			}
 			m = sc->ti_cdata.ti_rx_std_chain[rxidx];
 			sc->ti_cdata.ti_rx_std_chain[rxidx] = NULL;
 			if (cur_rx->ti_flags & TI_BDFLAG_ERROR) {