svn commit: r331538 - head/sys/net

[Mark Johnston]

Author: markj
Date: Sun Mar 25 23:23:19 2018
New Revision: 331538
URL: https://svnweb.freebsd.org/changeset/base/331538

Log:
  Clamp IFLIB_RX_COPY_THRESH to MHLEN in iflib_rxd_pkt_get().
  
  If one has added fields to struct mbuf such that MHLEN is smaller than
  this threshold (128), iflib_rxd_pkt_get() may otherwise overrun the
  internal mbuf buffer while copying.
  
  Reviewed by:	mmacy
  MFC after:	3 days
  Sponsored by:	Dell EMC Isilon
  Differential Revision:	https://reviews.freebsd.org/D14843

Modified:
  head/sys/net/iflib.c

Modified: head/sys/net/iflib.c
==============================================================================
--- head/sys/net/iflib.c	Sun Mar 25 21:07:59 2018	(r331537)
+++ head/sys/net/iflib.c	Sun Mar 25 23:23:19 2018	(r331538)
@@ -2450,7 +2450,7 @@ iflib_rxd_pkt_get(iflib_rxq_t rxq, if_rxd_info_t ri)
 
 	/* should I merge this back in now that the two paths are basically duplicated? */
 	if (ri->iri_nfrags == 1 &&
-	    ri->iri_frags[0].irf_len <= IFLIB_RX_COPY_THRESH) {
+	    ri->iri_frags[0].irf_len <= MIN(IFLIB_RX_COPY_THRESH, MHLEN)) {
 		rxd_frag_to_sd(rxq, &ri->iri_frags[0], FALSE, &sd);
 		m = *sd.ifsd_m;
 		*sd.ifsd_m = NULL;