PR/59940 CVS commit: src/sys/dev/usb

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

The following reply was made to PR kern/59940; it has been noted by GNATS.

From: "Taylor R Campbell" <riastradh%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/59940 CVS commit: src/sys/dev/usb
Date: Sun, 1 Feb 2026 03:33:19 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Feb  1 03:33:19 UTC 2026
 
 Modified Files:
 	src/sys/dev/usb: usbnet.c
 
 Log Message:
 usbnet(9): Tighten tx path.
 
 1. Verify, don't just assert, that the packet length is below the
    buffer size.  Even if all the callers enforce the interface's MTU,
    I can't prove that the usbnet(9) tx buffer size is an upper bound
    enforced on the interface's MTU.
 
    We can remove the check later if we do enforce that upper bound at
    some point, which would probably be worth doing anyway since the
    MTU is checked earlier in the tx path.
 
 2. Assert, don't check, that c->unc_xfer is nonnull.  We can only
    reach the tx path if we cross if_init=usbnet_init_rx_tx, and that
    (via usbnet_tx_list_init) is guaranteed to fail and back out
    unless all of the usbnet_chain unc_xfers get initialized.
 
 3. If we can't fit the packet into a buffer, drop it -- don't leave
    it in the queue to try again when it still won't fit in the
    buffer.
 
 4. If the transfer for this packet fails, drop it -- don't leave it
    in the queue to try again just in case it might work better the
    next time.
 
 PR kern/59940: usbnet(9): uno_tx_prepare buffer overrun audit
 PR kern/59943: usbnet(9) keeps failed packet in queue to retry indefinitely
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.121 -r1.122 src/sys/dev/usb/usbnet.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.