D58898.id.diff
No OneTemporary
Actions

Size

618 B

Referenced Files

None

Subscribers

None

D58898.id.diff
View Options

	diff --git a/sys/dev/usb/wlan/if_rsu.c b/sys/dev/usb/wlan/if_rsu.c
	--- a/sys/dev/usb/wlan/if_rsu.c
	+++ b/sys/dev/usb/wlan/if_rsu.c
	@@ -2917,6 +2917,9 @@
	*/
	txd->txdw3 \|= htole32(SM(R92S_TXDW3_SEQ, prio));

	+ if (m0->m_pkthdr.len > RSU_TXBUFSZ - sizeof(*txd))
	+ return (EMSGSIZE);
	+
	if (ieee80211_radiotap_active_vap(vap)) {
	struct rsu_tx_radiotap_header *tap = &sc->sc_txtap;

	@@ -2925,7 +2928,6 @@
	}

	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
	- KASSERT(xferlen <= RSU_TXBUFSZ, ("%s: invalid length", __func__));
	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);

	data->buflen = xferlen;