[Bug 275616] bwn driver causes kernel panic after connect

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275616

--- Comment #14 from Mark Johnston <markj@FreeBSD.org> ---
Hmm, for bwn vap->iv_ic->ic_headroom is pretty big, it's equal to sizeof(struct
bwn_txhdr), which is 118 bytes.

So, ieee80211_mbuf_adjust() is going to set needed_space = 118 + 24 + 8 for
CCMP. If ieee80211_mbuf_adjust() needs to allocate a new mbuf header, the
header will have MHLEN - 150 = 10 bytes of space.

The assertion "needed_space <= MHLEN" should actually be "needed_space +
sizeof(struct ether_header) <= MHLEN", and I suspect that that assertion would
fail for bwn.  I'm not sure what changed in 14.0 to break - maybe struct mbuf
layout changes that made MHLEN smaller?

-- 
You are receiving this mail because:
You are the assignee for the bug.