NetBSD Problem Report #59940

From www@netbsd.org  Sat Jan 24 23:10:28 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 3C1B31A923D
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 24 Jan 2026 23:10:28 +0000 (UTC)
Message-Id: <20260124231027.3EA821A923E@mollari.NetBSD.org>
Date: Sat, 24 Jan 2026 23:10:27 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: usbnet(9): uno_tx_prepare buffer overrun audit
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         59940
>Category:       kern
>Synopsis:       usbnet(9): uno_tx_prepare buffer overrun audit
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jan 24 23:15:00 +0000 2026
>Last-Modified:  Sun Feb 01 03:35:02 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The usbnet(9) Foundation
>Environment:
>Description:

	When usbnet(9) decides to transmit a packet, it is the
	responsibility of the usbnet(9) driver to verify in its
	uno_tx_prepare function that the payload fits in the xfer
	buffer alongside any device-specific header.

	It's not clear all the drivers do this.

	And while most (all?) paths into interface tx limit the pktlen
	to the interface's MTU (at least bpf(4) rejects >MTU writes and
	the ip_output path fragments >MTU packets), it's not clear that
	usbnet(9) requires the MTU not to exceed the driver's buffer
	size.  So the following assertion might fire:

529 		KASSERT(m->m_pkthdr.len <= un->un_tx_bufsz);

https://nxr.netbsd.org/xref/src/sys/dev/usb/usbnet.c?r=1.121#529

>How-To-Repeat:

	code inspection and thought

>Fix:

	1. Enforce limit on MTU in usbnet(9), or find where it is
	   already enforced.

	2. Audit all the drivers to ensure they also check the buffer
	   size on tx.

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59940 CVS commit: src/sys/dev/usb
Date: Mon, 26 Jan 2026 01:27:46 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Mon Jan 26 01:27:46 UTC 2026

 Modified Files:
 	src/sys/dev/usb: if_ncm.c

 Log Message:
 ncm(4): Verify payload _and header_ fits in buffer.

 usbnet(9) only guarantees payload fits in buffer, doesn't know
 anything about the ncm(4) header overhead.

 PR kern/59940: usbnet(9): uno_tx_prepare buffer overrun audit


 To generate a diff of this commit:
 cvs rdiff -u -r1.2 -r1.3 src/sys/dev/usb/if_ncm.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59940 CVS commit: src/sys/dev/usb
Date: Sun, 1 Feb 2026 03:33:19 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Feb  1 03:33:19 UTC 2026

 Modified Files:
 	src/sys/dev/usb: usbnet.c

 Log Message:
 usbnet(9): Tighten tx path.

 1. Verify, don't just assert, that the packet length is below the
    buffer size.  Even if all the callers enforce the interface's MTU,
    I can't prove that the usbnet(9) tx buffer size is an upper bound
    enforced on the interface's MTU.

    We can remove the check later if we do enforce that upper bound at
    some point, which would probably be worth doing anyway since the
    MTU is checked earlier in the tx path.

 2. Assert, don't check, that c->unc_xfer is nonnull.  We can only
    reach the tx path if we cross if_init=usbnet_init_rx_tx, and that
    (via usbnet_tx_list_init) is guaranteed to fail and back out
    unless all of the usbnet_chain unc_xfers get initialized.

 3. If we can't fit the packet into a buffer, drop it -- don't leave
    it in the queue to try again when it still won't fit in the
    buffer.

 4. If the transfer for this packet fails, drop it -- don't leave it
    in the queue to try again just in case it might work better the
    next time.

 PR kern/59940: usbnet(9): uno_tx_prepare buffer overrun audit
 PR kern/59943: usbnet(9) keeps failed packet in queue to retry indefinitely


 To generate a diff of this commit:
 cvs rdiff -u -r1.121 -r1.122 src/sys/dev/usb/usbnet.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search