This is a resend of the series posted on 23 October, now with the patches inline: the first posting carried them as attachments, which b4 and Patchwork cannot use. The patches are unchanged and still apply to main.
Tom asked on another of my threads for CI results with each series: this one ran unchanged in U-Boot's Azure CI through a CI-only pull request, together with three of my other series (ext4, EFI capsule and block/disk), and all 91 jobs passed: https://github.com/u-boot/u-boot/pull/1064 https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13698 Three of the USB Ethernet host drivers take the lengths in the headers the adapter sends with each received frame without checking them against the transfer that carried them: - r8152 reads the rx descriptor before checking that one is there, and its bound on the packet length wraps when fewer than 28 bytes are left. - asix88179 bounds neither the number of packet headers nor the packet lengths, as Linux ax88179_rx_fixup() has done since 2022. - lan7x checks the frame length against what follows the first 4 bytes of its 10-byte header, and lan7x_free_pkt() steps over only 4 bytes. On LAN75xx the length also counts 2 bytes of padding, so every frame was handed up 2 bytes too long. An adapter that sends a short or inconsistent transfer then gets the driver to hand the network stack a packet that runs past the received data, and for r8152 past the receive buffer. Patches 1-3 add the checks, one driver each, following what the Linux drivers check. Patch 4 adds DM tests that bind each driver without a USB device behind it and feed its recv() and free_pkt() prepared transfers, and enables the drivers in sandbox_defconfig so they are built and run there. Without patches 1-3, seven of the eleven tests fail: the short and oversized transfers, the lan7x step to the next frame and the LAN75xx length. The well-formed cases pass on both, as does the r8152 descriptor length below the CRC size, which the old code rejected through its u16 wrap and which guards the change to int. With the series all eleven pass, and the rest of "ut dm" under test/py gives the same results with and without it. I tested this in sandbox only; I have none of these adapters. Jonas, your series "usb: eth: asix88179: Use a fixed URB buffer size and misc cleanup" from January bounds the packet header count in its ax88179_eth_recv() rewrite as well ([5/6]). Patch 2 here keeps to the checks alone, so either should rebase easily on top of the other. Ana Bobillo (4): usb: eth: r8152: Check the rx descriptor fits in the transfer usb: eth: asix88179: Bound the rx packet headers and packets usb: eth: lan7x: Account for the whole rx command header test: dm: Add tests for the USB Ethernet rx header checks configs/sandbox_defconfig | 5 + drivers/usb/eth/asix88179.c | 13 +- drivers/usb/eth/lan7x.c | 31 +-- drivers/usb/eth/lan7x.h | 4 + drivers/usb/eth/r8152.c | 13 +- test/dm/Makefile | 1 + test/dm/usb_eth.c | 375 ++++++++++++++++++++++++++++++++++++ 7 files changed, 426 insertions(+), 16 deletions(-) create mode 100644 test/dm/usb_eth.c base-commit: acc808479730e13e74199119eb9b2b9113999244
