Fri Aug 28 17:05:32 2020 UTC ()
usbnet: Reject buflen>MCLBYTES in usbnet_newbuf.


(riastradh)
diff -r1.38 -r1.39 src/sys/dev/usb/usbnet.c
cvs diff -r1.38 -r1.39 src/sys/dev/usb/usbnet.c (expand / switch to unified diff)

--- src/sys/dev/usb/usbnet.c 2020/03/15 23:04:51 1.38
+++ src/sys/dev/usb/usbnet.c 2020/08/28 17:05:32 1.39
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: usbnet.c,v 1.38 2020/03/15 23:04:51 thorpej Exp $ */ 1/* $NetBSD: usbnet.c,v 1.39 2020/08/28 17:05:32 riastradh Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2019 Matthew R. Green 4 * Copyright (c) 2019 Matthew R. Green
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -23,27 +23,27 @@ @@ -23,27 +23,27 @@
23 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
25 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE. 28 * SUCH DAMAGE.
29 */ 29 */
30 30
31/* 31/*
32 * Common code shared between USB network drivers. 32 * Common code shared between USB network drivers.
33 */ 33 */
34 34
35#include <sys/cdefs.h> 35#include <sys/cdefs.h>
36__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.38 2020/03/15 23:04:51 thorpej Exp $"); 36__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.39 2020/08/28 17:05:32 riastradh Exp $");
37 37
38#include <sys/param.h> 38#include <sys/param.h>
39#include <sys/kernel.h> 39#include <sys/kernel.h>
40#include <sys/kmem.h> 40#include <sys/kmem.h>
41#include <sys/module.h> 41#include <sys/module.h>
42#include <sys/atomic.h> 42#include <sys/atomic.h>
43 43
44#include <dev/usb/usbnet.h> 44#include <dev/usb/usbnet.h>
45#include <dev/usb/usbhist.h> 45#include <dev/usb/usbhist.h>
46 46
47struct usbnet_cdata { 47struct usbnet_cdata {
48 struct usbnet_chain *uncd_tx_chain; 48 struct usbnet_chain *uncd_tx_chain;
49 struct usbnet_chain *uncd_rx_chain; 49 struct usbnet_chain *uncd_rx_chain;
@@ -229,26 +229,29 @@ static void @@ -229,26 +229,29 @@ static void
229uno_intr(struct usbnet *un, usbd_status status) 229uno_intr(struct usbnet *un, usbd_status status)
230{ 230{
231 if (un->un_ops->uno_intr) 231 if (un->un_ops->uno_intr)
232 (*un->un_ops->uno_intr)(un, status); 232 (*un->un_ops->uno_intr)(un, status);
233} 233}
234 234
235/* Interrupt handling. */ 235/* Interrupt handling. */
236 236
237static struct mbuf * 237static struct mbuf *
238usbnet_newbuf(size_t buflen) 238usbnet_newbuf(size_t buflen)
239{ 239{
240 struct mbuf *m; 240 struct mbuf *m;
241 241
 242 if (buflen > MCLBYTES)
 243 return NULL;
 244
242 MGETHDR(m, M_DONTWAIT, MT_DATA); 245 MGETHDR(m, M_DONTWAIT, MT_DATA);
243 if (m == NULL) 246 if (m == NULL)
244 return NULL; 247 return NULL;
245 248
246 if (buflen > MHLEN - ETHER_ALIGN) { 249 if (buflen > MHLEN - ETHER_ALIGN) {
247 MCLGET(m, M_DONTWAIT); 250 MCLGET(m, M_DONTWAIT);
248 if (!(m->m_flags & M_EXT)) { 251 if (!(m->m_flags & M_EXT)) {
249 m_freem(m); 252 m_freem(m);
250 return NULL; 253 return NULL;
251 } 254 }
252 } 255 }
253 256
254 m_adj(m, ETHER_ALIGN); 257 m_adj(m, ETHER_ALIGN);