[src/netbsd-8]: src/sys/dev/usb Pull up following revision(s) (requested by r...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/69721794e0e5
branches:  netbsd-8
changeset: 937921:69721794e0e5
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Aug 28 19:44:22 2020 +0000

description:
Pull up following revision(s) (requested by riastradh in ticket #1599):

        sys/dev/usb/if_atu.c: revision 1.73
        sys/dev/usb/if_axe.c: apply patch
        sys/dev/usb/if_axen.c: apply patch

atu(4): Reject packets larger than MCLBYTES.

diffstat:

 sys/dev/usb/if_atu.c  |   8 ++++++--
 sys/dev/usb/if_axe.c  |   7 ++++---
 sys/dev/usb/if_axen.c |  10 ++++++++--
 3 files changed, 18 insertions(+), 7 deletions(-)

diffs (88 lines):

diff -r 8b1193bbd642 -r 69721794e0e5 sys/dev/usb/if_atu.c
--- a/sys/dev/usb/if_atu.c      Wed Aug 19 18:40:09 2020 +0000
+++ b/sys/dev/usb/if_atu.c      Fri Aug 28 19:44:22 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $ */
+/*     $NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $ */
 /*     $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
 /*
  * Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.3 2018/08/08 10:28:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.55.8.4 2020/08/28 19:44:22 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1687,6 +1687,10 @@
                DPRINTF(("%s: atu_rxeof: too short\n",
                    device_xname(sc->atu_dev)));
                goto done;
+       } else if (len > MCLBYTES) {
+               DPRINTF(("%s: atu_rxeof: too long\n",
+                   device_xname(sc->atu_dev)));
+               goto done;
        }
 
        h = (struct atu_rx_hdr *)c->atu_buf;
diff -r 8b1193bbd642 -r 69721794e0e5 sys/dev/usb/if_axe.c
--- a/sys/dev/usb/if_axe.c      Wed Aug 19 18:40:09 2020 +0000
+++ b/sys/dev/usb/if_axe.c      Fri Aug 28 19:44:22 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $   */
+/*     $NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $   */
 /*     $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */
 
 /*
@@ -87,7 +87,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.4 2018/08/08 10:28:35 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.82.6.5 2020/08/28 19:44:22 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1382,7 +1382,8 @@
                }
 
                if (pktlen > MHLEN - ETHER_ALIGN) {
-                       MCLGET(m, M_DONTWAIT);
+                       if (pktlen <= MCLBYTES)
+                               MCLGET(m, M_DONTWAIT);
                        if ((m->m_flags & M_EXT) == 0) {
                                m_freem(m);
                                ifp->if_ierrors++;
diff -r 8b1193bbd642 -r 69721794e0e5 sys/dev/usb/if_axen.c
--- a/sys/dev/usb/if_axen.c     Wed Aug 19 18:40:09 2020 +0000
+++ b/sys/dev/usb/if_axen.c     Fri Aug 28 19:44:22 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $  */
+/*     $NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $  */
 /*     $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
 
 /*
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.8 2019/05/13 12:40:13 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.11.8.9 2020/08/28 19:44:22 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1097,6 +1097,12 @@
                            pkt_count));
                        goto nextpkt;
                }
+               if (pkt_len > MCLBYTES) {
+                       ifp->if_ierrors++;
+                       DPRINTF(("%s: oversize frame %d\n",
+                           device_xname(sc->axen_dev), pkt_len));
+                       goto nextpkt;
+               }
 
                /* process each packet */
                /* allocate mbuf */