sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2025-12-12 23:15:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

[ncm] Treat a zero divisor as indicating no alignment requirements

Browse Source 
A zero divisor will currently lead to a 16-bit integer overflow when
calculating the transmit padding, and a potential division by zero if
assertions are enabled.

Avoid these problems by treating a divisor value of zero as equivalent
to a divisor value of one (i.e. no alignment requirements).

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2020-10-02 00:04:26 +01:00
parent 0220141710
commit eede697ece
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/drivers/net/ncm.c
View File

@@ -558,6 +558,8 @@ static int ncm_probe ( struct usb_function *func,
struct usb_interface_descriptor *comms; struct usb_interface_descriptor *comms;
struct ecm_ethernet_descriptor *ethernet; struct ecm_ethernet_descriptor *ethernet;
struct ncm_ntb_parameters params; struct ncm_ntb_parameters params;
unsigned int remainder;
unsigned int divisor;
int rc; int rc;
/* Allocate and initialise structure */ /* Allocate and initialise structure */
@@ -616,14 +618,15 @@ static int ncm_probe ( struct usb_function *func,
DBGC2 ( ncm, "NCM %p maximum IN size is %zd bytes\n", ncm, ncm->mtu ); DBGC2 ( ncm, "NCM %p maximum IN size is %zd bytes\n", ncm, ncm->mtu );
/* Calculate transmit padding */ /* Calculate transmit padding */
ncm->padding = ( ( le16_to_cpu ( params.out.remainder ) - divisor = ( params.out.divisor ?
sizeof ( struct ncm_ntb_header ) - ETH_HLEN ) & le16_to_cpu ( params.out.divisor ) : 1 );
( le16_to_cpu ( params.out.divisor ) - 1 ) ); remainder = le16_to_cpu ( params.out.remainder );
ncm->padding = ( ( remainder - sizeof ( struct ncm_ntb_header ) -
ETH_HLEN ) & ( divisor - 1 ) );
DBGC2 ( ncm, "NCM %p using %zd-byte transmit padding\n", DBGC2 ( ncm, "NCM %p using %zd-byte transmit padding\n",
ncm, ncm->padding ); ncm, ncm->padding );
assert ( ( ( sizeof ( struct ncm_ntb_header ) + ncm->padding + assert ( ( ( sizeof ( struct ncm_ntb_header ) + ncm->padding +
ETH_HLEN ) % le16_to_cpu ( params.out.divisor ) ) == ETH_HLEN ) % divisor ) == remainder );
le16_to_cpu ( params.out.remainder ) );
/* Register network device */ /* Register network device */
if ( ( rc = register_netdev ( netdev ) ) != 0 ) if ( ( rc = register_netdev ( netdev ) ) != 0 )