Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/trunk]: src/sys/dev/usb usbnet drivers: Avoid undefined behaviour if rea...



details:   https://anonhg.NetBSD.org/src/rev/b1cafed90310
branches:  trunk
changeset: 362538:b1cafed90310
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Thu Mar 03 05:54:21 2022 +0000

description:
usbnet drivers: Avoid undefined behaviour if read reg fails.

Some callers don't check the error code, e.g. ~all the mii phy
drivers using PHY_READ.  Just return zero if the device is gone or
the xfer fails for any other reason.

diffstat:

 sys/dev/usb/if_aue.c  |  13 +++++++++----
 sys/dev/usb/if_axe.c  |   9 ++++++---
 sys/dev/usb/if_axen.c |  12 ++++++++----
 sys/dev/usb/if_mos.c  |   9 ++++++---
 sys/dev/usb/if_mue.c  |  10 +++++++---
 sys/dev/usb/if_smsc.c |  10 +++++++---
 sys/dev/usb/if_udav.c |   7 +++++--
 sys/dev/usb/if_ure.c  |  10 +++++++---
 sys/dev/usb/if_url.c  |  12 +++++++++---
 9 files changed, 64 insertions(+), 28 deletions(-)

diffs (truncated from 374 to 300 lines):

diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_aue.c
--- a/sys/dev/usb/if_aue.c      Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_aue.c      Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_aue.c,v 1.184 2022/03/03 05:53:48 riastradh Exp $   */
+/*     $NetBSD: if_aue.c,v 1.185 2022/03/03 05:54:21 riastradh Exp $   */
 
 /*
  * Copyright (c) 1997, 1998, 1999, 2000
@@ -76,7 +76,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_aue.c,v 1.184 2022/03/03 05:53:48 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_aue.c,v 1.185 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -466,8 +466,10 @@
         */
        if (sc->aue_vendor == USB_VENDOR_ADMTEK &&
            sc->aue_product == USB_PRODUCT_ADMTEK_PEGASUS) {
-               if (phy == 3)
+               if (phy == 3) {
+                       *val = 0;
                        return EINVAL;
+               }
        }
 #endif
 
@@ -475,8 +477,10 @@
        aue_csr_write_1(sc, AUE_PHY_CTL, reg | AUE_PHYCTL_READ);
 
        for (i = 0; i < AUE_TIMEOUT; i++) {
-               if (usbnet_isdying(un))
+               if (usbnet_isdying(un)) {
+                       *val = 0;
                        return ENXIO;
+               }
                if (aue_csr_read_1(sc, AUE_PHY_CTL) & AUE_PHYCTL_DONE)
                        break;
        }
@@ -484,6 +488,7 @@
        if (i == AUE_TIMEOUT) {
                AUEHIST_CALLARGS("aue%jd: phy=%#jx reg=%#jx read timed out",
                    device_unit(un->un_dev), phy, reg, 0);
+               *val = 0;
                return ETIMEDOUT;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_axe.c
--- a/sys/dev/usb/if_axe.c      Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_axe.c      Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_axe.c,v 1.143 2022/03/03 05:53:33 riastradh Exp $   */
+/*     $NetBSD: if_axe.c,v 1.144 2022/03/03 05:54:21 riastradh Exp $   */
 /*     $OpenBSD: if_axe.c,v 1.137 2016/04/13 11:03:37 mpi Exp $ */
 
 /*
@@ -87,7 +87,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.143 2022/03/03 05:53:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axe.c,v 1.144 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -324,8 +324,10 @@
 
        DPRINTFN(30, "phy %#jx reg %#jx\n", phy, reg, 0, 0);
 
-       if (un->un_phyno != phy)
+       if (un->un_phyno != phy) {
+               *val = 0;
                return EINVAL;
+       }
 
        axe_cmd(sc, AXE_CMD_MII_OPMODE_SW, 0, 0, NULL);
 
@@ -334,6 +336,7 @@
 
        if (err) {
                device_printf(un->un_dev, "read PHY failed\n");
+               *val = 0;
                return EIO;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_axen.c
--- a/sys/dev/usb/if_axen.c     Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_axen.c     Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_axen.c,v 1.87 2022/03/03 05:54:11 riastradh Exp $   */
+/*     $NetBSD: if_axen.c,v 1.88 2022/03/03 05:54:21 riastradh Exp $   */
 /*     $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
 
 /*
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.87 2022/03/03 05:54:11 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.88 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -137,12 +137,16 @@
 {
        uint16_t data;
 
-       if (un->un_phyno != phy)
+       if (un->un_phyno != phy) {
+               *val = 0;
                return EINVAL;
+       }
 
        usbd_status err = axen_cmd(un, AXEN_CMD_MII_READ_REG, reg, phy, &data);
-       if (err)
+       if (err) {
+               *val = 0;
                return EIO;
+       }
 
        *val = le16toh(data);
        if (reg == MII_BMSR)
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_mos.c
--- a/sys/dev/usb/if_mos.c      Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_mos.c      Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_mos.c,v 1.16 2022/03/03 05:53:33 riastradh Exp $    */
+/*     $NetBSD: if_mos.c,v 1.17 2022/03/03 05:54:21 riastradh Exp $    */
 /*     $OpenBSD: if_mos.c,v 1.40 2019/07/07 06:40:10 kevlo Exp $       */
 
 /*
@@ -72,7 +72,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mos.c,v 1.16 2022/03/03 05:53:33 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mos.c,v 1.17 2022/03/03 05:54:21 riastradh Exp $");
 
 #include <sys/param.h>
 
@@ -364,13 +364,16 @@
            MOS_PHYSTS_PENDING);
 
        for (i = 0; i < MOS_TIMEOUT; i++) {
-               if (usbnet_isdying(un))
+               if (usbnet_isdying(un)) {
+                       *val = 0;
                        return ENXIO;
+               }
                if (mos_reg_read_1(un, MOS_PHY_STS) & MOS_PHYSTS_READY)
                        break;
        }
        if (i == MOS_TIMEOUT) {
                aprint_error_dev(un->un_dev, "read PHY failed\n");
+               *val = 0;
                return EIO;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_mue.c
--- a/sys/dev/usb/if_mue.c      Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_mue.c      Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_mue.c,v 1.75 2022/03/03 05:54:03 riastradh Exp $    */
+/*     $NetBSD: if_mue.c,v 1.76 2022/03/03 05:54:21 riastradh Exp $    */
 /*     $OpenBSD: if_mue.c,v 1.3 2018/08/04 16:42:46 jsg Exp $  */
 
 /*
@@ -20,7 +20,7 @@
 /* Driver for Microchip LAN7500/LAN7800 chipsets. */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.75 2022/03/03 05:54:03 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.76 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -219,11 +219,14 @@
 {
        uint32_t data;
 
-       if (un->un_phyno != phy)
+       if (un->un_phyno != phy) {
+               *val = 0;
                return EINVAL;
+       }
 
        if (MUE_WAIT_CLR(un, MUE_MII_ACCESS, MUE_MII_ACCESS_BUSY, 0)) {
                MUE_PRINTF(un, "not ready\n");
+               *val = 0;
                return EBUSY;
        }
 
@@ -233,6 +236,7 @@
 
        if (MUE_WAIT_CLR(un, MUE_MII_ACCESS, MUE_MII_ACCESS_BUSY, 0)) {
                MUE_PRINTF(un, "timed out\n");
+               *val = 0;
                return ETIMEDOUT;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_smsc.c
--- a/sys/dev/usb/if_smsc.c     Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_smsc.c     Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_smsc.c,v 1.85 2022/03/03 05:54:03 riastradh Exp $   */
+/*     $NetBSD: if_smsc.c,v 1.86 2022/03/03 05:54:21 riastradh Exp $   */
 
 /*     $OpenBSD: if_smsc.c,v 1.4 2012/09/27 12:38:11 jsg Exp $ */
 /*     $FreeBSD: src/sys/dev/usb/net/if_smsc.c,v 1.1 2012/08/15 04:03:55 gonzo Exp $ */
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_smsc.c,v 1.85 2022/03/03 05:54:03 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_smsc.c,v 1.86 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -279,11 +279,14 @@
        uint32_t addr;
        uint32_t data = 0;
 
-       if (un->un_phyno != phy)
+       if (un->un_phyno != phy) {
+               *val = 0;
                return EINVAL;
+       }
 
        if (smsc_wait_for_bits(un, SMSC_MII_ADDR, SMSC_MII_BUSY) != 0) {
                smsc_warn_printf(un, "MII is busy\n");
+               *val = 0;
                return ETIMEDOUT;
        }
 
@@ -292,6 +295,7 @@
 
        if (smsc_wait_for_bits(un, SMSC_MII_ADDR, SMSC_MII_BUSY) != 0) {
                smsc_warn_printf(un, "MII read timeout\n");
+               *val = 0;
                return ETIMEDOUT;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_udav.c
--- a/sys/dev/usb/if_udav.c     Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_udav.c     Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_udav.c,v 1.90 2022/03/03 05:53:56 riastradh Exp $   */
+/*     $NetBSD: if_udav.c,v 1.91 2022/03/03 05:54:21 riastradh Exp $   */
 /*     $nabe: if_udav.c,v 1.3 2003/08/21 16:57:19 nabe Exp $   */
 
 /*
@@ -45,7 +45,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_udav.c,v 1.90 2022/03/03 05:53:56 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_udav.c,v 1.91 2022/03/03 05:54:21 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -383,6 +383,7 @@
        if (err) {
                DPRINTF(("%s: %s: read failed. off=%04x, err=%d\n",
                         device_xname(un->un_dev), __func__, offset, err));
+               memset(buf, 0, len);
        }
 
        return err;
@@ -731,6 +732,7 @@
                printf("%s: %s: dying\n", device_xname(un->un_dev),
                       __func__);
 #endif
+               *val = 0;
                return EINVAL;
        }
 
@@ -738,6 +740,7 @@
        if (phy != 0) {
                DPRINTFN(0xff, ("%s: %s: phy=%d is not supported\n",
                         device_xname(un->un_dev), __func__, phy));
+               *val = 0;
                return EINVAL;
        }
 
diff -r 7505c015b0c3 -r b1cafed90310 sys/dev/usb/if_ure.c
--- a/sys/dev/usb/if_ure.c      Thu Mar 03 05:54:11 2022 +0000
+++ b/sys/dev/usb/if_ure.c      Thu Mar 03 05:54:21 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ure.c,v 1.50 2022/03/03 05:53:33 riastradh Exp $    */
+/*     $NetBSD: if_ure.c,v 1.51 2022/03/03 05:54:21 riastradh Exp $    */
 /*     $OpenBSD: if_ure.c,v 1.10 2018/11/02 21:32:30 jcs Exp $ */
 
 /*-
@@ -30,7 +30,7 @@
 /* RealTek RTL8152/RTL8153 10/100/Gigabit USB Ethernet device */
 
 #include <sys/cdefs.h>



Home | Main Index | Thread Index | Old Index