Fri Aug 28 19:44:22 2020 UTC ()
Pull up following revision(s) (requested by riastradh in ticket #1599):
sys/dev/usb/if_atu.c: revision 1.73
sys/dev/usb/if_axe.c: apply patch
sys/dev/usb/if_axen.c: apply patch
atu(4): Reject packets larger than MCLBYTES.
(martin)
diff -r1.55.8.3 -r1.55.8.4 src/sys/dev/usb/if_atu.c
diff -r1.82.6.4 -r1.82.6.5 src/sys/dev/usb/if_axe.c
diff -r1.11.8.8 -r1.11.8.9 src/sys/dev/usb/if_axen.c
--- src/sys/dev/usb/if_atu.c 2018/08/08 10:28:35 1.55.8.3
+++ src/sys/dev/usb/if_atu.c 2020/08/28 19:44:22 1.55.8.4
@@ -1,4 +1,4 @@
-/* $NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $ */
+/* $NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $ */
/* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
/*
* Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -1685,6 +1685,10 @@
if (len <= 1) {
DPRINTF(("%s: atu_rxeof: too short\n",
+ device_xname(sc->atu_dev)));
+ goto done;
+ } else if (len > MCLBYTES) {
+ DPRINTF(("%s: atu_rxeof: too long\n",
device_xname(sc->atu_dev)));
goto done;
}
--- src/sys/dev/usb/if_axe.c 2018/08/08 10:28:35 1.82.6.4
+++ src/sys/dev/usb/if_axe.c 2020/08/28 19:44:22 1.82.6.5
@@ -1,4 +1,4 @@
-/* $NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $ */
+/* $NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $ */
/* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */
/*
@@ -87,7 +87,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1382,7 +1382,8 @@
}
if (pktlen > MHLEN - ETHER_ALIGN) {
- MCLGET(m, M_DONTWAIT);
+ if (pktlen <= MCLBYTES)
+ MCLGET(m, M_DONTWAIT);
if ((m->m_flags & M_EXT) == 0) {
m_freem(m);
ifp->if_ierrors++;
--- src/sys/dev/usb/if_axen.c 2019/05/13 12:40:13 1.11.8.8
+++ src/sys/dev/usb/if_axen.c 2020/08/28 19:44:22 1.11.8.9
@@ -1,4 +1,4 @@
-/* $NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $ */
+/* $NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $ */
/* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
/*
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1095,6 +1095,12 @@
device_xname(sc->axen_dev),
(pkt_hdr & AXEN_RXHDR_CRC_ERR) ? "crc" : "drop",
pkt_count));
+ goto nextpkt;
+ }
+ if (pkt_len > MCLBYTES) {
+ ifp->if_ierrors++;
+ DPRINTF(("%s: oversize frame %d\n",
+ device_xname(sc->axen_dev), pkt_len));
goto nextpkt;
}