[src/trunk]: src/sys/arch/sandpoint/stand/altboot Fix tftp boot with RTL8169/...

[rin <rin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/e12a371a1040
branches:  trunk
changeset: 960649:e12a371a1040
user:      rin <rin%NetBSD.org@localhost>
date:      Thu Mar 25 03:44:25 2021 +0000

description:
Fix tftp boot with RTL8169/8110.

When sending frame shorter than 60 octets, we add trailing \0's to
payload to construct 60-octet frame.

rge.c rev 1.4--1.7 did this tail-padding on buffer provided by caller,
which results in memory corruption if buffer is shorter than 60 bytes.

Instead, allocate temporary buffer on stack, and work on it.

This bug affects tftp_getnextblock() compiled by GCC8 and later, by
which stack layout has drastically changed. However, even with GCC7,
if tftp.c is compiled with -O0, the bug becomes tangible.

diffstat:

 sys/arch/sandpoint/stand/altboot/rge.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (26 lines):

diff -r 8a28f35c8907 -r e12a371a1040 sys/arch/sandpoint/stand/altboot/rge.c
--- a/sys/arch/sandpoint/stand/altboot/rge.c    Thu Mar 25 01:42:53 2021 +0000
+++ b/sys/arch/sandpoint/stand/altboot/rge.c    Thu Mar 25 03:44:25 2021 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: rge.c,v 1.7 2012/12/25 17:07:06 phx Exp $ */
+/* $NetBSD: rge.c,v 1.8 2021/03/25 03:44:25 rin Exp $ */
 
 /*-
  * Copyright (c) 2007 The NetBSD Foundation, Inc.
@@ -235,11 +235,15 @@
        struct local *l = dev;
        volatile struct desc *txd;
        unsigned loop, ret;
+       char tmp[60];
 
        ret = len;
+       /* RTL does not stretch <60 Tx frame */
        if (len < 60) {
+               memcpy(tmp, buf, len);
+               buf = tmp;
                memset(buf + len, 0, 60 - len);
-               len = 60; /* RTL does not stretch <60 Tx frame */
+               len = 60;
        }
        wbinv(buf, len);
        txd = &l->txd[l->tx];