narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[ncm] Treat a zero divisor as indicating no alignment requirements 

A zero divisor will currently lead to a 16-bit integer overflow when
calculating the transmit padding, and a potential division by zero if
assertions are enabled.

Avoid these problems by treating a divisor value of zero as equivalent
to a divisor value of one (i.e. no alignment requirements).

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/154/head
Michael Brown 2020-10-02 00:04:26 +01:00
parent 0220141710
commit eede697ece
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/drivers/net/ncm.c
View File

@ -558,6 +558,8 @@ static int ncm_probe ( struct usb_function *func,
struct usb_interface_descriptor *comms;
struct ecm_ethernet_descriptor *ethernet;
struct ncm_ntb_parameters params;
unsigned int remainder;
unsigned int divisor;
int rc;
/* Allocate and initialise structure */
@ -616,14 +618,15 @@ static int ncm_probe ( struct usb_function *func,
DBGC2 ( ncm, "NCM %p maximum IN size is %zd bytes\n", ncm, ncm->mtu );
/* Calculate transmit padding */
ncm->padding = ( ( le16_to_cpu ( params.out.remainder ) -
sizeof ( struct ncm_ntb_header ) - ETH_HLEN ) &
( le16_to_cpu ( params.out.divisor ) - 1 ) );
divisor = ( params.out.divisor ?
le16_to_cpu ( params.out.divisor ) : 1 );
remainder = le16_to_cpu ( params.out.remainder );
ncm->padding = ( ( remainder - sizeof ( struct ncm_ntb_header ) -
ETH_HLEN ) & ( divisor - 1 ) );
DBGC2 ( ncm, "NCM %p using %zd-byte transmit padding\n",
ncm, ncm->padding );
assert ( ( ( sizeof ( struct ncm_ntb_header ) + ncm->padding +
ETH_HLEN ) % le16_to_cpu ( params.out.divisor ) ) ==
le16_to_cpu ( params.out.remainder ) );
ETH_HLEN ) % divisor ) == remainder );
/* Register network device */
if ( ( rc = register_netdev ( netdev ) ) != 0 )