Module Name: src
Committed By: riastradh
Date: Fri Aug 28 19:02:19 UTC 2020
Modified Files:
src/sys/dev/usb: if_atu.c
Log Message:
atu(4): Reject packets larger than MCLBYTES.
To generate a diff of this commit:
cvs rdiff -u -r1.72 -r1.73 src/sys/dev/usb/if_atu.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/if_atu.c
diff -u src/sys/dev/usb/if_atu.c:1.72 src/sys/dev/usb/if_atu.c:1.73
--- src/sys/dev/usb/if_atu.c:1.72 Sun Mar 15 23:04:50 2020
+++ src/sys/dev/usb/if_atu.c Fri Aug 28 19:02:19 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: if_atu.c,v 1.72 2020/03/15 23:04:50 thorpej Exp $ */
+/* $NetBSD: if_atu.c,v 1.73 2020/08/28 19:02:19 riastradh Exp $ */
/* $OpenBSD: if_atu.c,v 1.48 2004/12/30 01:53:21 dlg Exp $ */
/*
* Copyright (c) 2003, 2004
@@ -48,7 +48,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.72 2020/03/15 23:04:50 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atu.c,v 1.73 2020/08/28 19:02:19 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -1679,6 +1679,10 @@ atu_rxeof(struct usbd_xfer *xfer, void *
DPRINTF(("%s: atu_rxeof: too short\n",
device_xname(sc->atu_dev)));
goto done;
+ } else if (len > MCLBYTES) {
+ DPRINTF(("%s: atu_rxeof: too long\n",
+ device_xname(sc->atu_dev)));
+ goto done;
}
h = (struct atu_rx_hdr *)c->atu_buf;
