[src/trunk]: src/sys/dev/usb atu(4): Reject packets larger than MCLBYTES.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f6a466f9129c
branches:  trunk
changeset: 975432:f6a466f9129c
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Aug 28 19:02:19 2020 +0000

description:
atu(4): Reject packets larger than MCLBYTES.

diffstat:

 sys/dev/usb/if_atu.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r e25cc4afbf00 -r f6a466f9129c sys/dev/usb/if_atu.c
--- a/sys/dev/usb/if_atu.c      Fri Aug 28 18:46:05 2020 +0000
+++ b/sys/dev/usb/if_atu.c      Fri Aug 28 19:02:19 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_atu.c,v 1.72 2020/03/15 23:04:50 thorpej Exp $ */
+/*     $NetBSD: if_atu.c,v 1.73 2020/08/28 19:02:19 riastradh Exp $ */
 /*     $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
 /*
  * Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.72 2020/03/15 23:04:50 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.73 2020/08/28 19:02:19 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1679,6 +1679,10 @@
                DPRINTF(("%s: atu_rxeof: too short\n",
                    device_xname(sc->atu_dev)));
                goto done;
+       } else if (len > MCLBYTES) {
+               DPRINTF(("%s: atu_rxeof: too long\n",
+                   device_xname(sc->atu_dev)));
+               goto done;
        }
 
        h = (struct atu_rx_hdr *)c->atu_buf;