CVS commit: [netbsd-9] src/sys/dev/usb

[Martin Husemann]

Module Name:    src
Committed By:   martin
Date:           Fri Aug 28 19:36:34 UTC 2020

Modified Files:
        src/sys/dev/usb [netbsd-9]: if_atu.c usbnet.c

Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1067):

        sys/dev/usb/usbnet.c: revision 1.39
        sys/dev/usb/if_atu.c: revision 1.73

usbnet: Reject buflen>MCLBYTES in usbnet_newbuf.
atu(4): Reject packets larger than MCLBYTES.


To generate a diff of this commit:
cvs rdiff -u -r1.65 -r1.65.2.1 src/sys/dev/usb/if_atu.c
cvs rdiff -u -r1.25.2.4 -r1.25.2.5 src/sys/dev/usb/usbnet.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/usb/if_atu.c
diff -u src/sys/dev/usb/if_atu.c:1.65 src/sys/dev/usb/if_atu.c:1.65.2.1
--- src/sys/dev/usb/if_atu.c:1.65	Sun May  5 03:17:54 2019
+++ src/sys/dev/usb/if_atu.c	Fri Aug 28 19:36:34 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_atu.c,v 1.65 2019/05/05 03:17:54 mrg Exp $ */
+/*	$NetBSD: if_atu.c,v 1.65.2.1 2020/08/28 19:36:34 martin Exp $ */
 /*	$OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
 /*
  * Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.65 2019/05/05 03:17:54 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.65.2.1 2020/08/28 19:36:34 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1680,6 +1680,10 @@ atu_rxeof(struct usbd_xfer *xfer, void *
 		DPRINTF(("%s: atu_rxeof: too short\n",
 		    device_xname(sc->atu_dev)));
 		goto done;
+	} else if (len > MCLBYTES) {
+		DPRINTF(("%s: atu_rxeof: too long\n",
+		    device_xname(sc->atu_dev)));
+		goto done;
 	}
 
 	h = (struct atu_rx_hdr *)c->atu_buf;

Index: src/sys/dev/usb/usbnet.c
diff -u src/sys/dev/usb/usbnet.c:1.25.2.4 src/sys/dev/usb/usbnet.c:1.25.2.5
--- src/sys/dev/usb/usbnet.c:1.25.2.4	Tue Dec 17 12:55:10 2019
+++ src/sys/dev/usb/usbnet.c	Fri Aug 28 19:36:34 2020
@@ -1,4 +1,4 @@
-/*	$NetBSD: usbnet.c,v 1.25.2.4 2019/12/17 12:55:10 martin Exp $	*/
+/*	$NetBSD: usbnet.c,v 1.25.2.5 2020/08/28 19:36:34 martin Exp $	*/
 
 /*
  * Copyright (c) 2019 Matthew R. Green
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.25.2.4 2019/12/17 12:55:10 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.25.2.5 2020/08/28 19:36:34 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -227,6 +227,9 @@ usbnet_newbuf(size_t buflen)
 {
 	struct mbuf *m;
 
+	if (buflen > MCLBYTES)
+		return NULL;
+
 	MGETHDR(m, M_DONTWAIT, MT_DATA);
 	if (m == NULL)
 		return NULL;