[PATCH RESEND 0/4] usb: eth: Check rx header lengths in r8152, asix88179 and lan7x

[Ana Bobillo <anabobillo3@gmail.com>]

This is a resend of the series posted on 23 October, now with the
patches inline: the first posting carried them as attachments, which b4
and Patchwork cannot use. The patches are unchanged and still apply to
main.

Tom asked on another of my threads for CI results with each series:
this one ran unchanged in U-Boot's Azure CI through a CI-only pull
request, together with three of my other series (ext4, EFI capsule and
block/disk), and all 91 jobs passed:
https://github.com/u-boot/u-boot/pull/1064
https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13698

Three of the USB Ethernet host drivers take the lengths in the headers
the adapter sends with each received frame without checking them against
the transfer that carried them:

- r8152 reads the rx descriptor before checking that one is there, and
  its bound on the packet length wraps when fewer than 28 bytes are left.
- asix88179 bounds neither the number of packet headers nor the packet
  lengths, as Linux ax88179_rx_fixup() has done since 2022.
- lan7x checks the frame length against what follows the first 4 bytes
  of its 10-byte header, and lan7x_free_pkt() steps over only 4 bytes.
  On LAN75xx the length also counts 2 bytes of padding, so every frame
  was handed up 2 bytes too long.

An adapter that sends a short or inconsistent transfer then gets the
driver to hand the network stack a packet that runs past the received
data, and for r8152 past the receive buffer.

Patches 1-3 add the checks, one driver each, following what the Linux
drivers check. Patch 4 adds DM tests that bind each driver without a USB
device behind it and feed its recv() and free_pkt() prepared transfers,
and enables the drivers in sandbox_defconfig so they are built and run
there. Without patches 1-3, seven of the eleven tests fail: the short
and oversized transfers, the lan7x step to the next frame and the
LAN75xx length. The well-formed cases pass on both, as does the r8152
descriptor length below the CRC size, which the old code rejected
through its u16 wrap and which guards the change to int. With the
series all eleven pass, and the rest of "ut dm" under test/py gives the
same results with and without it.

I tested this in sandbox only; I have none of these adapters.

Jonas, your series "usb: eth: asix88179: Use a fixed URB buffer size and
misc cleanup" from January bounds the packet header count in its
ax88179_eth_recv() rewrite as well ([5/6]). Patch 2 here keeps to the
checks alone, so either should rebase easily on top of the other.

Ana Bobillo (4):
  usb: eth: r8152: Check the rx descriptor fits in the transfer
  usb: eth: asix88179: Bound the rx packet headers and packets
  usb: eth: lan7x: Account for the whole rx command header
  test: dm: Add tests for the USB Ethernet rx header checks

 configs/sandbox_defconfig   |   5 +
 drivers/usb/eth/asix88179.c |  13 +-
 drivers/usb/eth/lan7x.c     |  31 +--
 drivers/usb/eth/lan7x.h     |   4 +
 drivers/usb/eth/r8152.c     |  13 +-
 test/dm/Makefile            |   1 +
 test/dm/usb_eth.c           | 375 ++++++++++++++++++++++++++++++++++++
 7 files changed, 426 insertions(+), 16 deletions(-)
 create mode 100644 test/dm/usb_eth.c


base-commit: acc808479730e13e74199119eb9b2b9113999244