diff options
| author | Michael Brown <mcb30@ipxe.org> | 2020-10-02 00:04:26 +0100 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2020-10-02 00:04:26 +0100 |
| commit | eede697ece879c5f9bba341a155f03235c42f2df (patch) | |
| tree | 7c062987233342b34a916f00162129338ca218f7 | |
| parent | 02201417104c751545dda261eb33f0012703d1ff (diff) | |
| download | ipxe-eede697ece879c5f9bba341a155f03235c42f2df.tar.gz | |
[ncm] Treat a zero divisor as indicating no alignment requirements
A zero divisor will currently lead to a 16-bit integer overflow when
calculating the transmit padding, and a potential division by zero if
assertions are enabled.
Avoid these problems by treating a divisor value of zero as equivalent
to a divisor value of one (i.e. no alignment requirements).
Signed-off-by: Michael Brown <mcb30@ipxe.org>
| -rw-r--r-- | src/drivers/net/ncm.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/src/drivers/net/ncm.c b/src/drivers/net/ncm.c index 1837291f7..cc07a4388 100644 --- a/src/drivers/net/ncm.c +++ b/src/drivers/net/ncm.c @@ -558,6 +558,8 @@ static int ncm_probe ( struct usb_function *func, struct usb_interface_descriptor *comms; struct ecm_ethernet_descriptor *ethernet; struct ncm_ntb_parameters params; + unsigned int remainder; + unsigned int divisor; int rc; /* Allocate and initialise structure */ @@ -616,14 +618,15 @@ static int ncm_probe ( struct usb_function *func, DBGC2 ( ncm, "NCM %p maximum IN size is %zd bytes\n", ncm, ncm->mtu ); /* Calculate transmit padding */ - ncm->padding = ( ( le16_to_cpu ( params.out.remainder ) - - sizeof ( struct ncm_ntb_header ) - ETH_HLEN ) & - ( le16_to_cpu ( params.out.divisor ) - 1 ) ); + divisor = ( params.out.divisor ? + le16_to_cpu ( params.out.divisor ) : 1 ); + remainder = le16_to_cpu ( params.out.remainder ); + ncm->padding = ( ( remainder - sizeof ( struct ncm_ntb_header ) - + ETH_HLEN ) & ( divisor - 1 ) ); DBGC2 ( ncm, "NCM %p using %zd-byte transmit padding\n", ncm, ncm->padding ); assert ( ( ( sizeof ( struct ncm_ntb_header ) + ncm->padding + - ETH_HLEN ) % le16_to_cpu ( params.out.divisor ) ) == - le16_to_cpu ( params.out.remainder ) ); + ETH_HLEN ) % divisor ) == remainder ); /* Register network device */ if ( ( rc = register_netdev ( netdev ) ) != 0 ) |