urndis0: urndis_decap invalid buffer len 1 < minimum header 44

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

urndis0: urndis_decap invalid buffer len 1 < minimum header 44

Artturi Alm
Hi,

spam in the subject does make ttyC0 unusable in practice with urndis(4).
I don't like repeating myself, so all i provide is the link where this
behaviour requiring while (len > 1) is explained:
https://docs.microsoft.com/en-us/windows-hardware/drivers/network/usb-short-packets

I'm running the minimal diff below on amd64 running 6.4.

-Artturi


diff --git a/sys/dev/usb/if_urndis.c b/sys/dev/usb/if_urndis.c
index f6b3c7bad9d..c5b4bc4ed3c 100644
--- a/sys/dev/usb/if_urndis.c
+++ b/sys/dev/usb/if_urndis.c
@@ -826,7 +826,7 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
  ifp = GET_IFP(sc);
  offset = 0;
 
- while (len > 0) {
+ while (len > 1) {
  msg = (struct rndis_packet_msg *)((char*)c->sc_buf + offset);
  m = c->sc_mbuf;
 
@@ -839,7 +839,7 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
     DEVNAME(sc),
     len,
     sizeof(*msg));
- return;
+ break;
  }
 
  DPRINTF(("%s: urndis_decap len %u data(off:%u len:%u) "
@@ -859,14 +859,14 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
     DEVNAME(sc),
     letoh32(msg->rm_type),
     REMOTE_NDIS_PACKET_MSG);
- return;
+ break;
  }
  if (letoh32(msg->rm_len) < sizeof(*msg)) {
  printf("%s: urndis_decap invalid msg len %u < %zu\n",
     DEVNAME(sc),
     letoh32(msg->rm_len),
     sizeof(*msg));
- return;
+ break;
  }
  if (letoh32(msg->rm_len) > len) {
  printf("%s: urndis_decap invalid msg len %u > buffer "
@@ -874,7 +874,7 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
     DEVNAME(sc),
     letoh32(msg->rm_len),
     len);
- return;
+ break;
  }
 
  if (letoh32(msg->rm_dataoffset) +
@@ -889,7 +889,7 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
     letoh32(msg->rm_dataoffset) +
     letoh32(msg->rm_datalen) + RNDIS_HEADER_OFFSET,
     letoh32(msg->rm_len));
- return;
+ break;
  }
 
  if (letoh32(msg->rm_datalen) < sizeof(struct ether_header)) {
@@ -899,7 +899,7 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
     DEVNAME(sc),
     letoh32(msg->rm_datalen),
     sizeof(struct ether_header)));
- return;
+ break;
  }
 
  memcpy(mtod(m, char*),
@@ -916,6 +916,8 @@ urndis_decap(struct urndis_softc *sc, struct urndis_chain *c, u_int32_t len)
  offset += letoh32(msg->rm_len);
  len -= letoh32(msg->rm_len);
  }
+ if (ml_empty(&ml))
+ return;
 
  s = splnet();
  if_input(ifp, &ml);