Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sys/dev/usb usbnet drivers: Avoid undefined behaviour if rea...
details: https://anonhg.NetBSD.org/src/rev/b1cafed90310
branches: trunk
changeset: 362538:b1cafed90310
user: riastradh <riastradh%NetBSD.org@localhost>
date: Thu Mar 03 05:54:21 2022 +0000
description:
usbnet drivers: Avoid undefined behaviour if read reg fails.
Some callers don't check the error code, e.g. ~all the mii phy
drivers using PHY_READ. Just return zero if the device is gone or
the xfer fails for any other reason.
diffstat:
sys/dev/usb/if_aue.c | 13 +++++++++----
sys/dev/usb/if_axe.c | 9 ++++++---
sys/dev/usb/if_axen.c | 12 ++++++++----
sys/dev/usb/if_mos.c | 9 ++++++---
sys/dev/usb/if_mue.c | 10 +++++++---
sys/dev/usb/if_smsc.c | 10 +++++++---
sys/dev/usb/if_udav.c | 7 +++++--
sys/dev/usb/if_ure.c | 10 +++++++---
sys/dev/usb/if_url.c | 12 +++++++++---
9 files changed, 64 insertions(+), 28 deletions(-)
diffs (truncated from 374 to 300 lines):
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_aue.c
--- a/sys/dev/usb/if_aue.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_aue.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_aue.c,v 1.184 2022/03/03 05:53:48 riastradh Exp $ */
+/* $NetBSD: if_aue.c,v 1.185 2022/03/03 05:54:21 riastradh Exp $ */
/*
* Copyright (c) 1997, 1998, 1999, 2000
@@ -76,7 +76,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_aue.c,v 1.184 2022/03/03 05:53:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_aue.c,v 1.185 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -466,8 +466,10 @@
*/
if (sc->aue_vendor == USB_VENDOR_ADMTEK &&
sc->aue_product == USB_PRODUCT_ADMTEK_PEGASUS) {
- if (phy == 3)
+ if (phy == 3) {
+ *val = 0;
return EINVAL;
+ }
}
#endif
@@ -475,8 +477,10 @@
aue_csr_write_1(sc, AUE_PHY_CTL, reg | AUE_PHYCTL_READ);
for (i = 0; i < AUE_TIMEOUT; i++) {
- if (usbnet_isdying(un))
+ if (usbnet_isdying(un)) {
+ *val = 0;
return ENXIO;
+ }
if (aue_csr_read_1(sc, AUE_PHY_CTL) & AUE_PHYCTL_DONE)
break;
}
@@ -484,6 +488,7 @@
if (i == AUE_TIMEOUT) {
AUEHIST_CALLARGS("aue%jd: phy=%#jx reg=%#jx read timed out",
device_unit(un->un_dev), phy, reg, 0);
+ *val = 0;
return ETIMEDOUT;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_axe.c
--- a/sys/dev/usb/if_axe.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_axe.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_axe.c,v 1.143 2022/03/03 05:53:33 riastradh Exp $ */
+/* $NetBSD: if_axe.c,v 1.144 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */
/*
@@ -87,7 +87,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.143 2022/03/03 05:53:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.144 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -324,8 +324,10 @@
DPRINTFN(30, "phy %#jx reg %#jx\n", phy, reg, 0, 0);
- if (un->un_phyno != phy)
+ if (un->un_phyno != phy) {
+ *val = 0;
return EINVAL;
+ }
axe_cmd(sc, AXE_CMD_MII_OPMODE_SW, 0, 0, NULL);
@@ -334,6 +336,7 @@
if (err) {
device_printf(un->un_dev, "read PHY failed\n");
+ *val = 0;
return EIO;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_axen.c
--- a/sys/dev/usb/if_axen.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_axen.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_axen.c,v 1.87 2022/03/03 05:54:11 riastradh Exp $ */
+/* $NetBSD: if_axen.c,v 1.88 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
/*
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.87 2022/03/03 05:54:11 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.88 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -137,12 +137,16 @@
{
uint16_t data;
- if (un->un_phyno != phy)
+ if (un->un_phyno != phy) {
+ *val = 0;
return EINVAL;
+ }
usbd_status err = axen_cmd(un, AXEN_CMD_MII_READ_REG, reg, phy, &data);
- if (err)
+ if (err) {
+ *val = 0;
return EIO;
+ }
*val = le16toh(data);
if (reg == MII_BMSR)
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_mos.c
--- a/sys/dev/usb/if_mos.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_mos.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_mos.c,v 1.16 2022/03/03 05:53:33 riastradh Exp $ */
+/* $NetBSD: if_mos.c,v 1.17 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_mos.c,v 1.40 2019/07/07 06:40:10 kevlo Exp $ */
/*
@@ -72,7 +72,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mos.c,v 1.16 2022/03/03 05:53:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mos.c,v 1.17 2022/03/03 05:54:21 riastradh Exp $");
#include <sys/param.h>
@@ -364,13 +364,16 @@
MOS_PHYSTS_PENDING);
for (i = 0; i < MOS_TIMEOUT; i++) {
- if (usbnet_isdying(un))
+ if (usbnet_isdying(un)) {
+ *val = 0;
return ENXIO;
+ }
if (mos_reg_read_1(un, MOS_PHY_STS) & MOS_PHYSTS_READY)
break;
}
if (i == MOS_TIMEOUT) {
aprint_error_dev(un->un_dev, "read PHY failed\n");
+ *val = 0;
return EIO;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_mue.c
--- a/sys/dev/usb/if_mue.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_mue.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_mue.c,v 1.75 2022/03/03 05:54:03 riastradh Exp $ */
+/* $NetBSD: if_mue.c,v 1.76 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_mue.c,v 1.3 2018/08/04 16:42:46 jsg Exp $ */
/*
@@ -20,7 +20,7 @@
/* Driver for Microchip LAN7500/LAN7800 chipsets. */
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.75 2022/03/03 05:54:03 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.76 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -219,11 +219,14 @@
{
uint32_t data;
- if (un->un_phyno != phy)
+ if (un->un_phyno != phy) {
+ *val = 0;
return EINVAL;
+ }
if (MUE_WAIT_CLR(un, MUE_MII_ACCESS, MUE_MII_ACCESS_BUSY, 0)) {
MUE_PRINTF(un, "not ready\n");
+ *val = 0;
return EBUSY;
}
@@ -233,6 +236,7 @@
if (MUE_WAIT_CLR(un, MUE_MII_ACCESS, MUE_MII_ACCESS_BUSY, 0)) {
MUE_PRINTF(un, "timed out\n");
+ *val = 0;
return ETIMEDOUT;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_smsc.c
--- a/sys/dev/usb/if_smsc.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_smsc.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_smsc.c,v 1.85 2022/03/03 05:54:03 riastradh Exp $ */
+/* $NetBSD: if_smsc.c,v 1.86 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_smsc.c,v 1.4 2012/09/27 12:38:11 jsg Exp $ */
/* $FreeBSD: src/sys/dev/usb/net/if_smsc.c,v 1.1 2012/08/15 04:03:55 gonzo Exp $ */
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_smsc.c,v 1.85 2022/03/03 05:54:03 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_smsc.c,v 1.86 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -279,11 +279,14 @@
uint32_t addr;
uint32_t data = 0;
- if (un->un_phyno != phy)
+ if (un->un_phyno != phy) {
+ *val = 0;
return EINVAL;
+ }
if (smsc_wait_for_bits(un, SMSC_MII_ADDR, SMSC_MII_BUSY) != 0) {
smsc_warn_printf(un, "MII is busy\n");
+ *val = 0;
return ETIMEDOUT;
}
@@ -292,6 +295,7 @@
if (smsc_wait_for_bits(un, SMSC_MII_ADDR, SMSC_MII_BUSY) != 0) {
smsc_warn_printf(un, "MII read timeout\n");
+ *val = 0;
return ETIMEDOUT;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_udav.c
--- a/sys/dev/usb/if_udav.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_udav.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_udav.c,v 1.90 2022/03/03 05:53:56 riastradh Exp $ */
+/* $NetBSD: if_udav.c,v 1.91 2022/03/03 05:54:21 riastradh Exp $ */
/* $nabe: if_udav.c,v 1.3 2003/08/21 16:57:19 nabe Exp $ */
/*
@@ -45,7 +45,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_udav.c,v 1.90 2022/03/03 05:53:56 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_udav.c,v 1.91 2022/03/03 05:54:21 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -383,6 +383,7 @@
if (err) {
DPRINTF(("%s: %s: read failed. off=%04x, err=%d\n",
device_xname(un->un_dev), __func__, offset, err));
+ memset(buf, 0, len);
}
return err;
@@ -731,6 +732,7 @@
printf("%s: %s: dying\n", device_xname(un->un_dev),
__func__);
#endif
+ *val = 0;
return EINVAL;
}
@@ -738,6 +740,7 @@
if (phy != 0) {
DPRINTFN(0xff, ("%s: %s: phy=%d is not supported\n",
device_xname(un->un_dev), __func__, phy));
+ *val = 0;
return EINVAL;
}
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_ure.c
--- a/sys/dev/usb/if_ure.c Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_ure.c Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: if_ure.c,v 1.50 2022/03/03 05:53:33 riastradh Exp $ */
+/* $NetBSD: if_ure.c,v 1.51 2022/03/03 05:54:21 riastradh Exp $ */
/* $OpenBSD: if_ure.c,v 1.10 2018/11/02 21:32:30 jcs Exp $ */
/*-
@@ -30,7 +30,7 @@
/* RealTek RTL8152/RTL8153 10/100/Gigabit USB Ethernet device */
#include <sys/cdefs.h>
Home |
Main Index |
Thread Index |
Old Index