Fri Aug 28 19:44:22 2020 UTC ()
Pull up following revision(s) (requested by riastradh in ticket #1599):

	sys/dev/usb/if_atu.c: revision 1.73
	sys/dev/usb/if_axe.c: apply patch
	sys/dev/usb/if_axen.c: apply patch

atu(4): Reject packets larger than MCLBYTES.


(martin)
diff -r1.55.8.3 -r1.55.8.4 src/sys/dev/usb/if_atu.c
diff -r1.82.6.4 -r1.82.6.5 src/sys/dev/usb/if_axe.c
diff -r1.11.8.8 -r1.11.8.9 src/sys/dev/usb/if_axen.c

cvs diff -r1.55.8.3 -r1.55.8.4 src/sys/dev/usb/if_atu.c (expand / switch to unified diff)

--- src/sys/dev/usb/if_atu.c 2018/08/08 10:28:35 1.55.8.3
+++ src/sys/dev/usb/if_atu.c 2020/08/28 19:44:22 1.55.8.4
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $ */ 1/* $NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $ */
2/* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */ 2/* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
3/* 3/*
4 * Copyright (c) 2003, 2004 4 * Copyright (c) 2003, 2004
5 * Daan Vreeken <Danovitsch@Vitsch.net>. All rights reserved. 5 * Daan Vreeken <Danovitsch@Vitsch.net>. All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -38,27 +38,27 @@ @@ -38,27 +38,27 @@
38 * 38 *
39 * Originally written by Daan Vreeken <Danovitsch @ Vitsch . net> 39 * Originally written by Daan Vreeken <Danovitsch @ Vitsch . net>
40 * http://vitsch.net/bsd/atuwi 40 * http://vitsch.net/bsd/atuwi
41 * 41 *
42 * Contributed to by : 42 * Contributed to by :
43 * Chris Whitehouse, Alistair Phillips, Peter Pilka, Martijn van Buul, 43 * Chris Whitehouse, Alistair Phillips, Peter Pilka, Martijn van Buul,
44 * Suihong Liang, Arjan van Leeuwen, Stuart Walsh 44 * Suihong Liang, Arjan van Leeuwen, Stuart Walsh
45 * 45 *
46 * Ported to OpenBSD by Theo de Raadt and David Gwynne. 46 * Ported to OpenBSD by Theo de Raadt and David Gwynne.
47 * Ported to NetBSD by Jesse Off 47 * Ported to NetBSD by Jesse Off
48 */ 48 */
49 49
50#include <sys/cdefs.h> 50#include <sys/cdefs.h>
51__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $"); 51__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $");
52 52
53#ifdef _KERNEL_OPT 53#ifdef _KERNEL_OPT
54#include "opt_usb.h" 54#include "opt_usb.h"
55#endif 55#endif
56 56
57#include <sys/param.h> 57#include <sys/param.h>
58#include <sys/sockio.h> 58#include <sys/sockio.h>
59#include <sys/mbuf.h> 59#include <sys/mbuf.h>
60#include <sys/kernel.h> 60#include <sys/kernel.h>
61#include <sys/socket.h> 61#include <sys/socket.h>
62#include <sys/systm.h> 62#include <sys/systm.h>
63#include <sys/kthread.h> 63#include <sys/kthread.h>
64#include <sys/queue.h> 64#include <sys/queue.h>
@@ -1677,26 +1677,30 @@ atu_rxeof(struct usbd_xfer *xfer, void * @@ -1677,26 +1677,30 @@ atu_rxeof(struct usbd_xfer *xfer, void *
1677 } 1677 }
1678 if (status == USBD_STALLED) 1678 if (status == USBD_STALLED)
1679 usbd_clear_endpoint_stall_async( 1679 usbd_clear_endpoint_stall_async(
1680 sc->atu_ep[ATU_ENDPT_RX]); 1680 sc->atu_ep[ATU_ENDPT_RX]);
1681 goto done; 1681 goto done;
1682 } 1682 }
1683 1683
1684 usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL); 1684 usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1685 1685
1686 if (len <= 1) { 1686 if (len <= 1) {
1687 DPRINTF(("%s: atu_rxeof: too short\n", 1687 DPRINTF(("%s: atu_rxeof: too short\n",
1688 device_xname(sc->atu_dev))); 1688 device_xname(sc->atu_dev)));
1689 goto done; 1689 goto done;
 1690 } else if (len > MCLBYTES) {
 1691 DPRINTF(("%s: atu_rxeof: too long\n",
 1692 device_xname(sc->atu_dev)));
 1693 goto done;
1690 } 1694 }
1691 1695
1692 h = (struct atu_rx_hdr *)c->atu_buf; 1696 h = (struct atu_rx_hdr *)c->atu_buf;
1693 len = UGETW(h->length) - 4; /* XXX magic number */ 1697 len = UGETW(h->length) - 4; /* XXX magic number */
1694 1698
1695 m = c->atu_mbuf; 1699 m = c->atu_mbuf;
1696 memcpy(mtod(m, char *), c->atu_buf + ATU_RX_HDRLEN, len); 1700 memcpy(mtod(m, char *), c->atu_buf + ATU_RX_HDRLEN, len);
1697 m_set_rcvif(m, ifp); 1701 m_set_rcvif(m, ifp);
1698 m->m_pkthdr.len = m->m_len = len; 1702 m->m_pkthdr.len = m->m_len = len;
1699 1703
1700 wh = mtod(m, struct ieee80211_frame_min *); 1704 wh = mtod(m, struct ieee80211_frame_min *);
1701 ni = ieee80211_find_rxnode(ic, wh); 1705 ni = ieee80211_find_rxnode(ic, wh);
1702 1706

cvs diff -r1.82.6.4 -r1.82.6.5 src/sys/dev/usb/if_axe.c (expand / switch to unified diff)

--- src/sys/dev/usb/if_axe.c 2018/08/08 10:28:35 1.82.6.4
+++ src/sys/dev/usb/if_axe.c 2020/08/28 19:44:22 1.82.6.5
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $ */ 1/* $NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $ */
2/* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */ 2/* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */
3 3
4/* 4/*
5 * Copyright (c) 2005, 2006, 2007 Jonathan Gray <jsg@openbsd.org> 5 * Copyright (c) 2005, 2006, 2007 Jonathan Gray <jsg@openbsd.org>
6 * 6 *
7 * Permission to use, copy, modify, and distribute this software for any 7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above 8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies. 9 * copyright notice and this permission notice appear in all copies.
10 * 10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
@@ -77,27 +77,27 @@ @@ -77,27 +77,27 @@
77 * (Adam Weinberger wanted me to name this driver if_gir.c.) 77 * (Adam Weinberger wanted me to name this driver if_gir.c.)
78 */ 78 */
79 79
80/* 80/*
81 * Ax88178 and Ax88772 support backported from the OpenBSD driver. 81 * Ax88178 and Ax88772 support backported from the OpenBSD driver.
82 * 2007/02/12, J.R. Oldroyd, fbsd@opal.com 82 * 2007/02/12, J.R. Oldroyd, fbsd@opal.com
83 * 83 *
84 * Manual here: 84 * Manual here:
85 * http://www.asix.com.tw/FrootAttach/datasheet/AX88178_datasheet_Rev10.pdf 85 * http://www.asix.com.tw/FrootAttach/datasheet/AX88178_datasheet_Rev10.pdf
86 * http://www.asix.com.tw/FrootAttach/datasheet/AX88772_datasheet_Rev10.pdf 86 * http://www.asix.com.tw/FrootAttach/datasheet/AX88772_datasheet_Rev10.pdf
87 */ 87 */
88 88
89#include <sys/cdefs.h> 89#include <sys/cdefs.h>
90__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $"); 90__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $");
91 91
92#ifdef _KERNEL_OPT 92#ifdef _KERNEL_OPT
93#include "opt_inet.h" 93#include "opt_inet.h"
94#include "opt_usb.h" 94#include "opt_usb.h"
95#include "opt_net_mpsafe.h" 95#include "opt_net_mpsafe.h"
96#endif 96#endif
97 97
98#include <sys/param.h> 98#include <sys/param.h>
99#include <sys/bus.h> 99#include <sys/bus.h>
100#include <sys/device.h> 100#include <sys/device.h>
101#include <sys/kernel.h> 101#include <sys/kernel.h>
102#include <sys/mbuf.h> 102#include <sys/mbuf.h>
103#include <sys/module.h> 103#include <sys/module.h>
@@ -1372,27 +1372,28 @@ axe_rxeof(struct usbd_xfer *xfer, void * @@ -1372,27 +1372,28 @@ axe_rxeof(struct usbd_xfer *xfer, void *
1372 " rxlen %#jx", total_len, len, pktlen, rxlen); 1372 " rxlen %#jx", total_len, len, pktlen, rxlen);
1373 } else { /* AX172 */ 1373 } else { /* AX172 */
1374 pktlen = rxlen = total_len; 1374 pktlen = rxlen = total_len;
1375 total_len = 0; 1375 total_len = 0;
1376 } 1376 }
1377 1377
1378 MGETHDR(m, M_DONTWAIT, MT_DATA); 1378 MGETHDR(m, M_DONTWAIT, MT_DATA);
1379 if (m == NULL) { 1379 if (m == NULL) {
1380 ifp->if_ierrors++; 1380 ifp->if_ierrors++;
1381 goto done; 1381 goto done;
1382 } 1382 }
1383 1383
1384 if (pktlen > MHLEN - ETHER_ALIGN) { 1384 if (pktlen > MHLEN - ETHER_ALIGN) {
1385 MCLGET(m, M_DONTWAIT); 1385 if (pktlen <= MCLBYTES)
 1386 MCLGET(m, M_DONTWAIT);
1386 if ((m->m_flags & M_EXT) == 0) { 1387 if ((m->m_flags & M_EXT) == 0) {
1387 m_freem(m); 1388 m_freem(m);
1388 ifp->if_ierrors++; 1389 ifp->if_ierrors++;
1389 goto done; 1390 goto done;
1390 } 1391 }
1391 } 1392 }
1392 m->m_data += ETHER_ALIGN; 1393 m->m_data += ETHER_ALIGN;
1393 1394
1394 m_set_rcvif(m, ifp); 1395 m_set_rcvif(m, ifp);
1395 m->m_pkthdr.len = m->m_len = pktlen; 1396 m->m_pkthdr.len = m->m_len = pktlen;
1396 m->m_pkthdr.csum_flags = flags; 1397 m->m_pkthdr.csum_flags = flags;
1397 1398
1398 memcpy(mtod(m, uint8_t *), buf, pktlen); 1399 memcpy(mtod(m, uint8_t *), buf, pktlen);

cvs diff -r1.11.8.8 -r1.11.8.9 src/sys/dev/usb/if_axen.c (expand / switch to unified diff)

--- src/sys/dev/usb/if_axen.c 2019/05/13 12:40:13 1.11.8.8
+++ src/sys/dev/usb/if_axen.c 2020/08/28 19:44:22 1.11.8.9
@@ -1,39 +1,39 @@ @@ -1,39 +1,39 @@
1/* $NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $ */ 1/* $NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $ */
2/* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */ 2/* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
3 3
4/* 4/*
5 * Copyright (c) 2013 Yojiro UO <yuo@openbsd.org> 5 * Copyright (c) 2013 Yojiro UO <yuo@openbsd.org>
6 * 6 *
7 * Permission to use, copy, modify, and distribute this software for any 7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above 8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies. 9 * copyright notice and this permission notice appear in all copies.
10 * 10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */ 18 */
19 19
20/* 20/*
21 * ASIX Electronics AX88178a USB 2.0 ethernet and AX88179 USB 3.0 Ethernet 21 * ASIX Electronics AX88178a USB 2.0 ethernet and AX88179 USB 3.0 Ethernet
22 * driver. 22 * driver.
23 */ 23 */
24 24
25#include <sys/cdefs.h> 25#include <sys/cdefs.h>
26__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $"); 26__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $");
27 27
28#ifdef _KERNEL_OPT 28#ifdef _KERNEL_OPT
29#include "opt_inet.h" 29#include "opt_inet.h"
30#include "opt_usb.h" 30#include "opt_usb.h"
31#endif 31#endif
32 32
33#include <sys/param.h> 33#include <sys/param.h>
34#include <sys/bus.h> 34#include <sys/bus.h>
35#include <sys/device.h> 35#include <sys/device.h>
36#include <sys/kernel.h> 36#include <sys/kernel.h>
37#include <sys/mbuf.h> 37#include <sys/mbuf.h>
38#include <sys/module.h> 38#include <sys/module.h>
39#include <sys/rwlock.h> 39#include <sys/rwlock.h>
@@ -1087,26 +1087,32 @@ axen_rxeof(struct usbd_xfer *xfer, void  @@ -1087,26 +1087,32 @@ axen_rxeof(struct usbd_xfer *xfer, void
1087 DPRINTFN(10, 1087 DPRINTFN(10,
1088 ("%s: rxeof: packet#%d, pkt_hdr 0x%08x, pkt_len %zu\n", 1088 ("%s: rxeof: packet#%d, pkt_hdr 0x%08x, pkt_len %zu\n",
1089 device_xname(sc->axen_dev), pkt_count, pkt_hdr, pkt_len)); 1089 device_xname(sc->axen_dev), pkt_count, pkt_hdr, pkt_len));
1090 1090
1091 if (pkt_hdr & (AXEN_RXHDR_CRC_ERR | AXEN_RXHDR_DROP_ERR)) { 1091 if (pkt_hdr & (AXEN_RXHDR_CRC_ERR | AXEN_RXHDR_DROP_ERR)) {
1092 ifp->if_ierrors++; 1092 ifp->if_ierrors++;
1093 /* move to next pkt header */ 1093 /* move to next pkt header */
1094 DPRINTF(("%s: %s err (pkt#%d)\n", 1094 DPRINTF(("%s: %s err (pkt#%d)\n",
1095 device_xname(sc->axen_dev), 1095 device_xname(sc->axen_dev),
1096 (pkt_hdr & AXEN_RXHDR_CRC_ERR) ? "crc" : "drop", 1096 (pkt_hdr & AXEN_RXHDR_CRC_ERR) ? "crc" : "drop",
1097 pkt_count)); 1097 pkt_count));
1098 goto nextpkt; 1098 goto nextpkt;
1099 } 1099 }
 1100 if (pkt_len > MCLBYTES) {
 1101 ifp->if_ierrors++;
 1102 DPRINTF(("%s: oversize frame %d\n",
 1103 device_xname(sc->axen_dev), pkt_len));
 1104 goto nextpkt;
 1105 }
1100 1106
1101 /* process each packet */ 1107 /* process each packet */
1102 /* allocate mbuf */ 1108 /* allocate mbuf */
1103 m = axen_newbuf(); 1109 m = axen_newbuf();
1104 if (m == NULL) { 1110 if (m == NULL) {
1105 ifp->if_ierrors++; 1111 ifp->if_ierrors++;
1106 goto nextpkt; 1112 goto nextpkt;
1107 } 1113 }
1108 1114
1109 /* skip pseudo header (2byte) */ 1115 /* skip pseudo header (2byte) */
1110 m_set_rcvif(m, ifp); 1116 m_set_rcvif(m, ifp);
1111 m->m_pkthdr.len = m->m_len = pkt_len - 6; 1117 m->m_pkthdr.len = m->m_len = pkt_len - 6;
1112 1118