Module Name: src Committed By: martin Date: Fri Aug 28 19:44:22 UTC 2020
Modified Files: src/sys/dev/usb [netbsd-8]: if_atu.c if_axe.c if_axen.c Log Message: Pull up following revision(s) (requested by riastradh in ticket #1599): sys/dev/usb/if_atu.c: revision 1.73 sys/dev/usb/if_axe.c: apply patch sys/dev/usb/if_axen.c: apply patch atu(4): Reject packets larger than MCLBYTES. To generate a diff of this commit: cvs rdiff -u -r1.55.8.3 -r1.55.8.4 src/sys/dev/usb/if_atu.c cvs rdiff -u -r1.82.6.4 -r1.82.6.5 src/sys/dev/usb/if_axe.c cvs rdiff -u -r1.11.8.8 -r1.11.8.9 src/sys/dev/usb/if_axen.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/usb/if_atu.c diff -u src/sys/dev/usb/if_atu.c:1.55.8.3 src/sys/dev/usb/if_atu.c:1.55.8.4 --- src/sys/dev/usb/if_atu.c:1.55.8.3 Wed Aug 8 10:28:35 2018 +++ src/sys/dev/usb/if_atu.c Fri Aug 28 19:44:22 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $ */ +/* $NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $ */ /* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */ /* * Copyright (c) 2003, 2004 @@ -48,7 +48,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $"); #ifdef _KERNEL_OPT #include "opt_usb.h" @@ -1687,6 +1687,10 @@ atu_rxeof(struct usbd_xfer *xfer, void * DPRINTF(("%s: atu_rxeof: too short\n", device_xname(sc->atu_dev))); goto done; + } else if (len > MCLBYTES) { + DPRINTF(("%s: atu_rxeof: too long\n", + device_xname(sc->atu_dev))); + goto done; } h = (struct atu_rx_hdr *)c->atu_buf; Index: src/sys/dev/usb/if_axe.c diff -u src/sys/dev/usb/if_axe.c:1.82.6.4 src/sys/dev/usb/if_axe.c:1.82.6.5 --- src/sys/dev/usb/if_axe.c:1.82.6.4 Wed Aug 8 10:28:35 2018 +++ src/sys/dev/usb/if_axe.c Fri Aug 28 19:44:22 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $ */ +/* $NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $ */ /* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */ /* @@ -87,7 +87,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $"); #ifdef _KERNEL_OPT #include "opt_inet.h" @@ -1382,7 +1382,8 @@ axe_rxeof(struct usbd_xfer *xfer, void * } if (pktlen > MHLEN - ETHER_ALIGN) { - MCLGET(m, M_DONTWAIT); + if (pktlen <= MCLBYTES) + MCLGET(m, M_DONTWAIT); if ((m->m_flags & M_EXT) == 0) { m_freem(m); ifp->if_ierrors++; Index: src/sys/dev/usb/if_axen.c diff -u src/sys/dev/usb/if_axen.c:1.11.8.8 src/sys/dev/usb/if_axen.c:1.11.8.9 --- src/sys/dev/usb/if_axen.c:1.11.8.8 Mon May 13 12:40:13 2019 +++ src/sys/dev/usb/if_axen.c Fri Aug 28 19:44:22 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $ */ +/* $NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $ */ /* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */ /* @@ -23,7 +23,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $"); #ifdef _KERNEL_OPT #include "opt_inet.h" @@ -1097,6 +1097,12 @@ axen_rxeof(struct usbd_xfer *xfer, void pkt_count)); goto nextpkt; } + if (pkt_len > MCLBYTES) { + ifp->if_ierrors++; + DPRINTF(("%s: oversize frame %d\n", + device_xname(sc->axen_dev), pkt_len)); + goto nextpkt; + } /* process each packet */ /* allocate mbuf */