From 7fce145b3043e7ee13c72286674d51e9888935c3 Mon Sep 17 00:00:00 2001
From: chao an <anchao@xiaomi.com>
Date: Mon, 30 Jan 2023 21:36:39 +0800
Subject: [PATCH] net/devif: check the net device before use

Signed-off-by: chao an <anchao@xiaomi.com>
---
 net/devif/devif_iobsend.c | 78 ++++++++++++++++++---------------------
 net/devif/devif_send.c    | 64 +++++++++++++++++---------------
 2 files changed, 70 insertions(+), 72 deletions(-)

diff --git a/net/devif/devif_iobsend.c b/net/devif/devif_iobsend.c
index 55db92f053..1dd068841a 100644
--- a/net/devif/devif_iobsend.c
+++ b/net/devif/devif_iobsend.c
@@ -27,6 +27,7 @@
 #include <string.h>
 #include <assert.h>
 #include <debug.h>
+#include <errno.h>
 
 #include <nuttx/mm/iob.h>
 #include <nuttx/net/netdev.h>
@@ -56,67 +57,58 @@ void devif_iob_send(FAR struct net_driver_s *dev, FAR struct iob_s *iob,
                     unsigned int len, unsigned int offset,
                     unsigned int target_offset)
 {
-#ifndef CONFIG_NET_IPFRAG
-  unsigned int limit = NETDEV_PKTSIZE(dev) -
-                       NET_LL_HDRLEN(dev) - target_offset;
+  int ret;
 
-  if (dev == NULL || len == 0 || len > limit)
-#else
-  if (dev == NULL || len == 0)
-#endif
+  if (dev == NULL)
     {
-      if (dev->d_iob == NULL)
-        {
-          iob_free_chain(iob);
-        }
+      ret = -ENODEV;
+      goto errout;
+    }
+
+  if (len == 0)
+    {
+      ret = -EINVAL;
+      goto errout;
+    }
 
 #ifndef CONFIG_NET_IPFRAG
-      nerr("devif_iob_send error, %p, send len: %u, limit len: %u\n",
-           dev, len, limit);
-#else
-      nerr("devif_iob_send error, %p, send len: %u\n", dev, len);
-#endif
-      return;
+  if (len > NETDEV_PKTSIZE(dev) - NET_LL_HDRLEN(dev) - target_offset)
+    {
+      ret = -EMSGSIZE;
+      goto errout;
     }
+#endif
 
   /* Append the send buffer after device buffer */
 
-  if (dev->d_iob != NULL)
+  if (len > iob_navail(false) * CONFIG_IOB_BUFSIZE)
     {
-      dev->d_sndlen = 0;
-
-      if (len > iob_navail(false) * CONFIG_IOB_BUFSIZE)
-        {
-          return;
-        }
-
-      /* Clone the iob to target device buffer */
-
-      if (iob_clone_partial(iob, len, offset, dev->d_iob,
-                            target_offset, false, false) != OK)
-        {
-          netdev_iob_release(dev);
-          nerr("devif_iob_send error, not enough iob entries, "
-              "send len: %u\n", len);
-          return;
-        }
-
-      dev->d_sndlen = len;
+      ret = -ENOMEM;
+      goto errout;
     }
-  else
+
+  /* Clone the iob to target device buffer */
+
+  ret = iob_clone_partial(iob, len, offset, dev->d_iob,
+                          target_offset, false, false);
+  if (ret != OK)
     {
-      /* Send the iob directly if no device buffer */
-
-      dev->d_iob    = iob;
-      dev->d_sndlen = len;
-      dev->d_buf    = NETLLBUF;
+      netdev_iob_release(dev);
+      goto errout;
     }
 
+  dev->d_sndlen = len;
+
 #ifdef CONFIG_NET_TCP_WRBUFFER_DUMP
   /* Dump the outgoing device buffer */
 
   lib_dumpbuffer("devif_iob_send", dev->d_appdata, len);
 #endif
+
+  return;
+
+errout:
+  nerr("ERROR: devif_iob_send error: %d\n", ret);
 }
 
 #endif /* CONFIG_MM_IOB */
diff --git a/net/devif/devif_send.c b/net/devif/devif_send.c
index 4c0faca0a7..f2532c42de 100644
--- a/net/devif/devif_send.c
+++ b/net/devif/devif_send.c
@@ -44,6 +44,7 @@
 #include <string.h>
 #include <assert.h>
 #include <debug.h>
+#include <errno.h>
 
 #include <nuttx/net/netdev.h>
 
@@ -68,47 +69,52 @@
 void devif_send(FAR struct net_driver_s *dev, FAR const void *buf,
                 int len, unsigned int offset)
 {
-#ifndef CONFIG_NET_IPFRAG
-  unsigned int limit = NETDEV_PKTSIZE(dev) -
-                       NET_LL_HDRLEN(dev) - offset;
+  int ret;
 
-  if (dev == NULL || len == 0 || len > limit)
+  if (dev == NULL)
     {
-      nerr("ERROR: devif_send fail: %p, sndlen: %u, pktlen: %u\n",
-           dev, len, limit);
-      return;
+      ret = -ENODEV;
+      goto errout;
     }
-#else
-  if (dev == NULL || len == 0)
+
+  if (len == 0)
     {
-      nerr("ERROR: devif_send fail: %p, sndlen: %u\n", dev, len);
-      return;
+      ret = -EINVAL;
+      goto errout;
+    }
+
+#ifndef CONFIG_NET_IPFRAG
+  if (len > NETDEV_PKTSIZE(dev) - NET_LL_HDRLEN(dev) - offset)
+    {
+      ret = -EMSGSIZE;
+      goto errout;
     }
 #endif
 
-  /* Copy in iob to target device buffer */
+  /* Append the send buffer after device buffer */
 
-  if (len <= iob_navail(false) * CONFIG_IOB_BUFSIZE)
+  if (len > iob_navail(false) * CONFIG_IOB_BUFSIZE &&
+      netdev_iob_prepare(dev, false, 0) != OK)
     {
-      /* Prepare device buffer before poll callback */
-
-      if (netdev_iob_prepare(dev, false, 0) != OK)
-        {
-          return;
-        }
-
-      iob_update_pktlen(dev->d_iob, offset);
-
-      dev->d_sndlen = iob_trycopyin(dev->d_iob, buf, len, offset, false);
-    }
-  else
-    {
-      dev->d_sndlen = 0;
+      ret = -ENOMEM;
+      goto errout;
     }
 
-  if (dev->d_sndlen != len)
+  /* Prepare device buffer before poll callback */
+
+  iob_update_pktlen(dev->d_iob, offset);
+
+  ret = iob_trycopyin(dev->d_iob, buf, len, offset, false);
+  if (ret != len)
     {
       netdev_iob_release(dev);
-      dev->d_sndlen = 0;
+      goto errout;
     }
+
+  dev->d_sndlen = len;
+
+  return;
+
+errout:
+  nerr("ERROR: devif_send error: %d\n", ret);
 }