Pull up following revision(s) (requested by riastradh in ticket #1599): sys/dev/usb/if_atu.c: revision 1.73 sys/dev/usb/if_axe.c: apply patch sys/dev/usb/if_axen.c: apply patch atu(4): Reject packets larger than MCLBYTES.diff -r1.55.8.3 -r1.55.8.4 src/sys/dev/usb/if_atu.c
(martin)
--- src/sys/dev/usb/if_atu.c 2018/08/08 10:28:35 1.55.8.3
+++ src/sys/dev/usb/if_atu.c 2020/08/28 19:44:22 1.55.8.4
@@ -1,14 +1,14 @@ | @@ -1,14 +1,14 @@ | |||
1 | /* $NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $ */ | 1 | /* $NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $ */ | |
2 | /* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */ | 2 | /* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */ | |
3 | /* | 3 | /* | |
4 | * Copyright (c) 2003, 2004 | 4 | * Copyright (c) 2003, 2004 | |
5 | * Daan Vreeken <Danovitsch@Vitsch.net>. All rights reserved. | 5 | * Daan Vreeken <Danovitsch@Vitsch.net>. All rights reserved. | |
6 | * | 6 | * | |
7 | * Redistribution and use in source and binary forms, with or without | 7 | * Redistribution and use in source and binary forms, with or without | |
8 | * modification, are permitted provided that the following conditions | 8 | * modification, are permitted provided that the following conditions | |
9 | * are met: | 9 | * are met: | |
10 | * 1. Redistributions of source code must retain the above copyright | 10 | * 1. Redistributions of source code must retain the above copyright | |
11 | * notice, this list of conditions and the following disclaimer. | 11 | * notice, this list of conditions and the following disclaimer. | |
12 | * 2. Redistributions in binary form must reproduce the above copyright | 12 | * 2. Redistributions in binary form must reproduce the above copyright | |
13 | * notice, this list of conditions and the following disclaimer in the | 13 | * notice, this list of conditions and the following disclaimer in the | |
14 | * documentation and/or other materials provided with the distribution. | 14 | * documentation and/or other materials provided with the distribution. | |
@@ -38,27 +38,27 @@ | @@ -38,27 +38,27 @@ | |||
38 | * | 38 | * | |
39 | * Originally written by Daan Vreeken <Danovitsch @ Vitsch . net> | 39 | * Originally written by Daan Vreeken <Danovitsch @ Vitsch . net> | |
40 | * http://vitsch.net/bsd/atuwi | 40 | * http://vitsch.net/bsd/atuwi | |
41 | * | 41 | * | |
42 | * Contributed to by : | 42 | * Contributed to by : | |
43 | * Chris Whitehouse, Alistair Phillips, Peter Pilka, Martijn van Buul, | 43 | * Chris Whitehouse, Alistair Phillips, Peter Pilka, Martijn van Buul, | |
44 | * Suihong Liang, Arjan van Leeuwen, Stuart Walsh | 44 | * Suihong Liang, Arjan van Leeuwen, Stuart Walsh | |
45 | * | 45 | * | |
46 | * Ported to OpenBSD by Theo de Raadt and David Gwynne. | 46 | * Ported to OpenBSD by Theo de Raadt and David Gwynne. | |
47 | * Ported to NetBSD by Jesse Off | 47 | * Ported to NetBSD by Jesse Off | |
48 | */ | 48 | */ | |
49 | 49 | |||
50 | #include <sys/cdefs.h> | 50 | #include <sys/cdefs.h> | |
51 | __KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $"); | 51 | __KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $"); | |
52 | 52 | |||
53 | #ifdef _KERNEL_OPT | 53 | #ifdef _KERNEL_OPT | |
54 | #include "opt_usb.h" | 54 | #include "opt_usb.h" | |
55 | #endif | 55 | #endif | |
56 | 56 | |||
57 | #include <sys/param.h> | 57 | #include <sys/param.h> | |
58 | #include <sys/sockio.h> | 58 | #include <sys/sockio.h> | |
59 | #include <sys/mbuf.h> | 59 | #include <sys/mbuf.h> | |
60 | #include <sys/kernel.h> | 60 | #include <sys/kernel.h> | |
61 | #include <sys/socket.h> | 61 | #include <sys/socket.h> | |
62 | #include <sys/systm.h> | 62 | #include <sys/systm.h> | |
63 | #include <sys/kthread.h> | 63 | #include <sys/kthread.h> | |
64 | #include <sys/queue.h> | 64 | #include <sys/queue.h> | |
@@ -1677,26 +1677,30 @@ atu_rxeof(struct usbd_xfer *xfer, void * | @@ -1677,26 +1677,30 @@ atu_rxeof(struct usbd_xfer *xfer, void * | |||
1677 | } | 1677 | } | |
1678 | if (status == USBD_STALLED) | 1678 | if (status == USBD_STALLED) | |
1679 | usbd_clear_endpoint_stall_async( | 1679 | usbd_clear_endpoint_stall_async( | |
1680 | sc->atu_ep[ATU_ENDPT_RX]); | 1680 | sc->atu_ep[ATU_ENDPT_RX]); | |
1681 | goto done; | 1681 | goto done; | |
1682 | } | 1682 | } | |
1683 | 1683 | |||
1684 | usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL); | 1684 | usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL); | |
1685 | 1685 | |||
1686 | if (len <= 1) { | 1686 | if (len <= 1) { | |
1687 | DPRINTF(("%s: atu_rxeof: too short\n", | 1687 | DPRINTF(("%s: atu_rxeof: too short\n", | |
1688 | device_xname(sc->atu_dev))); | 1688 | device_xname(sc->atu_dev))); | |
1689 | goto done; | 1689 | goto done; | |
1690 | } else if (len > MCLBYTES) { | |||
1691 | DPRINTF(("%s: atu_rxeof: too long\n", | |||
1692 | device_xname(sc->atu_dev))); | |||
1693 | goto done; | |||
1690 | } | 1694 | } | |
1691 | 1695 | |||
1692 | h = (struct atu_rx_hdr *)c->atu_buf; | 1696 | h = (struct atu_rx_hdr *)c->atu_buf; | |
1693 | len = UGETW(h->length) - 4; /* XXX magic number */ | 1697 | len = UGETW(h->length) - 4; /* XXX magic number */ | |
1694 | 1698 | |||
1695 | m = c->atu_mbuf; | 1699 | m = c->atu_mbuf; | |
1696 | memcpy(mtod(m, char *), c->atu_buf + ATU_RX_HDRLEN, len); | 1700 | memcpy(mtod(m, char *), c->atu_buf + ATU_RX_HDRLEN, len); | |
1697 | m_set_rcvif(m, ifp); | 1701 | m_set_rcvif(m, ifp); | |
1698 | m->m_pkthdr.len = m->m_len = len; | 1702 | m->m_pkthdr.len = m->m_len = len; | |
1699 | 1703 | |||
1700 | wh = mtod(m, struct ieee80211_frame_min *); | 1704 | wh = mtod(m, struct ieee80211_frame_min *); | |
1701 | ni = ieee80211_find_rxnode(ic, wh); | 1705 | ni = ieee80211_find_rxnode(ic, wh); | |
1702 | 1706 |
--- src/sys/dev/usb/if_axe.c 2018/08/08 10:28:35 1.82.6.4
+++ src/sys/dev/usb/if_axe.c 2020/08/28 19:44:22 1.82.6.5
@@ -1,14 +1,14 @@ | @@ -1,14 +1,14 @@ | |||
1 | /* $NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $ */ | 1 | /* $NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $ */ | |
2 | /* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */ | 2 | /* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */ | |
3 | 3 | |||
4 | /* | 4 | /* | |
5 | * Copyright (c) 2005, 2006, 2007 Jonathan Gray <jsg@openbsd.org> | 5 | * Copyright (c) 2005, 2006, 2007 Jonathan Gray <jsg@openbsd.org> | |
6 | * | 6 | * | |
7 | * Permission to use, copy, modify, and distribute this software for any | 7 | * Permission to use, copy, modify, and distribute this software for any | |
8 | * purpose with or without fee is hereby granted, provided that the above | 8 | * purpose with or without fee is hereby granted, provided that the above | |
9 | * copyright notice and this permission notice appear in all copies. | 9 | * copyright notice and this permission notice appear in all copies. | |
10 | * | 10 | * | |
11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | 11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |
12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | 12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |
13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | 13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |
14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | 14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |
@@ -77,27 +77,27 @@ | @@ -77,27 +77,27 @@ | |||
77 | * (Adam Weinberger wanted me to name this driver if_gir.c.) | 77 | * (Adam Weinberger wanted me to name this driver if_gir.c.) | |
78 | */ | 78 | */ | |
79 | 79 | |||
80 | /* | 80 | /* | |
81 | * Ax88178 and Ax88772 support backported from the OpenBSD driver. | 81 | * Ax88178 and Ax88772 support backported from the OpenBSD driver. | |
82 | * 2007/02/12, J.R. Oldroyd, fbsd@opal.com | 82 | * 2007/02/12, J.R. Oldroyd, fbsd@opal.com | |
83 | * | 83 | * | |
84 | * Manual here: | 84 | * Manual here: | |
85 | * http://www.asix.com.tw/FrootAttach/datasheet/AX88178_datasheet_Rev10.pdf | 85 | * http://www.asix.com.tw/FrootAttach/datasheet/AX88178_datasheet_Rev10.pdf | |
86 | * http://www.asix.com.tw/FrootAttach/datasheet/AX88772_datasheet_Rev10.pdf | 86 | * http://www.asix.com.tw/FrootAttach/datasheet/AX88772_datasheet_Rev10.pdf | |
87 | */ | 87 | */ | |
88 | 88 | |||
89 | #include <sys/cdefs.h> | 89 | #include <sys/cdefs.h> | |
90 | __KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $"); | 90 | __KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $"); | |
91 | 91 | |||
92 | #ifdef _KERNEL_OPT | 92 | #ifdef _KERNEL_OPT | |
93 | #include "opt_inet.h" | 93 | #include "opt_inet.h" | |
94 | #include "opt_usb.h" | 94 | #include "opt_usb.h" | |
95 | #include "opt_net_mpsafe.h" | 95 | #include "opt_net_mpsafe.h" | |
96 | #endif | 96 | #endif | |
97 | 97 | |||
98 | #include <sys/param.h> | 98 | #include <sys/param.h> | |
99 | #include <sys/bus.h> | 99 | #include <sys/bus.h> | |
100 | #include <sys/device.h> | 100 | #include <sys/device.h> | |
101 | #include <sys/kernel.h> | 101 | #include <sys/kernel.h> | |
102 | #include <sys/mbuf.h> | 102 | #include <sys/mbuf.h> | |
103 | #include <sys/module.h> | 103 | #include <sys/module.h> | |
@@ -1372,27 +1372,28 @@ axe_rxeof(struct usbd_xfer *xfer, void * | @@ -1372,27 +1372,28 @@ axe_rxeof(struct usbd_xfer *xfer, void * | |||
1372 | " rxlen %#jx", total_len, len, pktlen, rxlen); | 1372 | " rxlen %#jx", total_len, len, pktlen, rxlen); | |
1373 | } else { /* AX172 */ | 1373 | } else { /* AX172 */ | |
1374 | pktlen = rxlen = total_len; | 1374 | pktlen = rxlen = total_len; | |
1375 | total_len = 0; | 1375 | total_len = 0; | |
1376 | } | 1376 | } | |
1377 | 1377 | |||
1378 | MGETHDR(m, M_DONTWAIT, MT_DATA); | 1378 | MGETHDR(m, M_DONTWAIT, MT_DATA); | |
1379 | if (m == NULL) { | 1379 | if (m == NULL) { | |
1380 | ifp->if_ierrors++; | 1380 | ifp->if_ierrors++; | |
1381 | goto done; | 1381 | goto done; | |
1382 | } | 1382 | } | |
1383 | 1383 | |||
1384 | if (pktlen > MHLEN - ETHER_ALIGN) { | 1384 | if (pktlen > MHLEN - ETHER_ALIGN) { | |
1385 | MCLGET(m, M_DONTWAIT); | 1385 | if (pktlen <= MCLBYTES) | |
1386 | MCLGET(m, M_DONTWAIT); | |||
1386 | if ((m->m_flags & M_EXT) == 0) { | 1387 | if ((m->m_flags & M_EXT) == 0) { | |
1387 | m_freem(m); | 1388 | m_freem(m); | |
1388 | ifp->if_ierrors++; | 1389 | ifp->if_ierrors++; | |
1389 | goto done; | 1390 | goto done; | |
1390 | } | 1391 | } | |
1391 | } | 1392 | } | |
1392 | m->m_data += ETHER_ALIGN; | 1393 | m->m_data += ETHER_ALIGN; | |
1393 | 1394 | |||
1394 | m_set_rcvif(m, ifp); | 1395 | m_set_rcvif(m, ifp); | |
1395 | m->m_pkthdr.len = m->m_len = pktlen; | 1396 | m->m_pkthdr.len = m->m_len = pktlen; | |
1396 | m->m_pkthdr.csum_flags = flags; | 1397 | m->m_pkthdr.csum_flags = flags; | |
1397 | 1398 | |||
1398 | memcpy(mtod(m, uint8_t *), buf, pktlen); | 1399 | memcpy(mtod(m, uint8_t *), buf, pktlen); |
--- src/sys/dev/usb/if_axen.c 2019/05/13 12:40:13 1.11.8.8
+++ src/sys/dev/usb/if_axen.c 2020/08/28 19:44:22 1.11.8.9
@@ -1,39 +1,39 @@ | @@ -1,39 +1,39 @@ | |||
1 | /* $NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $ */ | 1 | /* $NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $ */ | |
2 | /* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */ | 2 | /* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */ | |
3 | 3 | |||
4 | /* | 4 | /* | |
5 | * Copyright (c) 2013 Yojiro UO <yuo@openbsd.org> | 5 | * Copyright (c) 2013 Yojiro UO <yuo@openbsd.org> | |
6 | * | 6 | * | |
7 | * Permission to use, copy, modify, and distribute this software for any | 7 | * Permission to use, copy, modify, and distribute this software for any | |
8 | * purpose with or without fee is hereby granted, provided that the above | 8 | * purpose with or without fee is hereby granted, provided that the above | |
9 | * copyright notice and this permission notice appear in all copies. | 9 | * copyright notice and this permission notice appear in all copies. | |
10 | * | 10 | * | |
11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | 11 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |
12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | 12 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |
13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | 13 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |
14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | 14 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |
15 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | 15 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |
16 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | 16 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |
17 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | 17 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
18 | */ | 18 | */ | |
19 | 19 | |||
20 | /* | 20 | /* | |
21 | * ASIX Electronics AX88178a USB 2.0 ethernet and AX88179 USB 3.0 Ethernet | 21 | * ASIX Electronics AX88178a USB 2.0 ethernet and AX88179 USB 3.0 Ethernet | |
22 | * driver. | 22 | * driver. | |
23 | */ | 23 | */ | |
24 | 24 | |||
25 | #include <sys/cdefs.h> | 25 | #include <sys/cdefs.h> | |
26 | __KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $"); | 26 | __KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $"); | |
27 | 27 | |||
28 | #ifdef _KERNEL_OPT | 28 | #ifdef _KERNEL_OPT | |
29 | #include "opt_inet.h" | 29 | #include "opt_inet.h" | |
30 | #include "opt_usb.h" | 30 | #include "opt_usb.h" | |
31 | #endif | 31 | #endif | |
32 | 32 | |||
33 | #include <sys/param.h> | 33 | #include <sys/param.h> | |
34 | #include <sys/bus.h> | 34 | #include <sys/bus.h> | |
35 | #include <sys/device.h> | 35 | #include <sys/device.h> | |
36 | #include <sys/kernel.h> | 36 | #include <sys/kernel.h> | |
37 | #include <sys/mbuf.h> | 37 | #include <sys/mbuf.h> | |
38 | #include <sys/module.h> | 38 | #include <sys/module.h> | |
39 | #include <sys/rwlock.h> | 39 | #include <sys/rwlock.h> | |
@@ -1087,26 +1087,32 @@ axen_rxeof(struct usbd_xfer *xfer, void | @@ -1087,26 +1087,32 @@ axen_rxeof(struct usbd_xfer *xfer, void | |||
1087 | DPRINTFN(10, | 1087 | DPRINTFN(10, | |
1088 | ("%s: rxeof: packet#%d, pkt_hdr 0x%08x, pkt_len %zu\n", | 1088 | ("%s: rxeof: packet#%d, pkt_hdr 0x%08x, pkt_len %zu\n", | |
1089 | device_xname(sc->axen_dev), pkt_count, pkt_hdr, pkt_len)); | 1089 | device_xname(sc->axen_dev), pkt_count, pkt_hdr, pkt_len)); | |
1090 | 1090 | |||
1091 | if (pkt_hdr & (AXEN_RXHDR_CRC_ERR | AXEN_RXHDR_DROP_ERR)) { | 1091 | if (pkt_hdr & (AXEN_RXHDR_CRC_ERR | AXEN_RXHDR_DROP_ERR)) { | |
1092 | ifp->if_ierrors++; | 1092 | ifp->if_ierrors++; | |
1093 | /* move to next pkt header */ | 1093 | /* move to next pkt header */ | |
1094 | DPRINTF(("%s: %s err (pkt#%d)\n", | 1094 | DPRINTF(("%s: %s err (pkt#%d)\n", | |
1095 | device_xname(sc->axen_dev), | 1095 | device_xname(sc->axen_dev), | |
1096 | (pkt_hdr & AXEN_RXHDR_CRC_ERR) ? "crc" : "drop", | 1096 | (pkt_hdr & AXEN_RXHDR_CRC_ERR) ? "crc" : "drop", | |
1097 | pkt_count)); | 1097 | pkt_count)); | |
1098 | goto nextpkt; | 1098 | goto nextpkt; | |
1099 | } | 1099 | } | |
1100 | if (pkt_len > MCLBYTES) { | |||
1101 | ifp->if_ierrors++; | |||
1102 | DPRINTF(("%s: oversize frame %d\n", | |||
1103 | device_xname(sc->axen_dev), pkt_len)); | |||
1104 | goto nextpkt; | |||
1105 | } | |||
1100 | 1106 | |||
1101 | /* process each packet */ | 1107 | /* process each packet */ | |
1102 | /* allocate mbuf */ | 1108 | /* allocate mbuf */ | |
1103 | m = axen_newbuf(); | 1109 | m = axen_newbuf(); | |
1104 | if (m == NULL) { | 1110 | if (m == NULL) { | |
1105 | ifp->if_ierrors++; | 1111 | ifp->if_ierrors++; | |
1106 | goto nextpkt; | 1112 | goto nextpkt; | |
1107 | } | 1113 | } | |
1108 | 1114 | |||
1109 | /* skip pseudo header (2byte) */ | 1115 | /* skip pseudo header (2byte) */ | |
1110 | m_set_rcvif(m, ifp); | 1116 | m_set_rcvif(m, ifp); | |
1111 | m->m_pkthdr.len = m->m_len = pkt_len - 6; | 1117 | m->m_pkthdr.len = m->m_len = pkt_len - 6; | |
1112 | 1118 |