[src/netbsd-9]: src/sys/dev/usb Pull up following revision(s) (requested by r...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d3b4e87f5adc
branches:  netbsd-9
changeset: 964096:d3b4e87f5adc
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Aug 28 19:36:34 2020 +0000

description:
Pull up following revision(s) (requested by riastradh in ticket #1067):

        sys/dev/usb/usbnet.c: revision 1.39
        sys/dev/usb/if_atu.c: revision 1.73

usbnet: Reject buflen>MCLBYTES in usbnet_newbuf.
atu(4): Reject packets larger than MCLBYTES.

diffstat:

 sys/dev/usb/if_atu.c |  8 ++++++--
 sys/dev/usb/usbnet.c |  7 +++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diffs (57 lines):

diff -r 30be15c20a12 -r d3b4e87f5adc sys/dev/usb/if_atu.c
--- a/sys/dev/usb/if_atu.c      Fri Aug 28 18:18:31 2020 +0000
+++ b/sys/dev/usb/if_atu.c      Fri Aug 28 19:36:34 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_atu.c,v 1.65 2019/05/05 03:17:54 mrg Exp $ */
+/*     $NetBSD: if_atu.c,v 1.65.2.1 2020/08/28 19:36:34 martin Exp $ */
 /*     $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
 /*
  * Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.65 2019/05/05 03:17:54 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.65.2.1 2020/08/28 19:36:34 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1680,6 +1680,10 @@
                DPRINTF(("%s: atu_rxeof: too short\n",
                    device_xname(sc->atu_dev)));
                goto done;
+       } else if (len > MCLBYTES) {
+               DPRINTF(("%s: atu_rxeof: too long\n",
+                   device_xname(sc->atu_dev)));
+               goto done;
        }
 
        h = (struct atu_rx_hdr *)c->atu_buf;
diff -r 30be15c20a12 -r d3b4e87f5adc sys/dev/usb/usbnet.c
--- a/sys/dev/usb/usbnet.c      Fri Aug 28 18:18:31 2020 +0000
+++ b/sys/dev/usb/usbnet.c      Fri Aug 28 19:36:34 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: usbnet.c,v 1.25.2.4 2019/12/17 12:55:10 martin Exp $   */
+/*     $NetBSD: usbnet.c,v 1.25.2.5 2020/08/28 19:36:34 martin Exp $   */
 
 /*
  * Copyright (c) 2019 Matthew R. Green
@@ -33,7 +33,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.25.2.4 2019/12/17 12:55:10 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usbnet.c,v 1.25.2.5 2020/08/28 19:36:34 martin Exp $");
 
 #include <sys/param.h>
 #include <sys/kernel.h>
@@ -227,6 +227,9 @@
 {
        struct mbuf *m;
 
+       if (buflen > MCLBYTES)
+               return NULL;
+
        MGETHDR(m, M_DONTWAIT, MT_DATA);
        if (m == NULL)
                return NULL;