drivers/slipdev: fix off-by-one error in _recv()

[benpicco]

Contribution description

If the number of written bytes is greater than the length of the buffer, we have already written out-of bounds memory.

With pktbuf this means we will likely have corrupted the next free list entry.

Testing procedure

Issues/PRs references

alternative to #18066

[kfessel]

I think it would be better to move that if from line 202 to line 193 and replace the return -ENOBUFS;
by

res= -ENOBUFS;
break;

without the move a write may happen to a "valid" pointer to a buffer of 0 length

[miri64]

Agreeing with @kfessel.

[benpicco]

Like this?

btw what's up with that _recv function? Why does it have a special case to drop len bytes if buf is NULL? This is the only driver I'm aware of that does that, and I can't think of a use case for when this would be useful.

[benpicco]

Hm a

sudo ping -A ff02::1%sl0

still kills it

[kfessel]

Suggested change

	if ((unsigned)res == len) {
	/* clear out unreceived packet */
	while (byte != SLIPDEV_END) {
	byte = tsrb_get_one(&dev->inbuf);
	}
	return -ENOBUFS;
	}
	if ( (unsigned) res >= len) {
	/* the result grew larger than the provided buffer
	clear out rest of the current packet, this package is lost */
	do {
	byte = tsrb_get_one(&dev->inbuf);
	} while (byte != SLIPDEV_END);
	res = -ENOBUFS;
	break;
	}

[kfessel]

do{ } while to not depend on the initialization of byte
res = .. ; break; to avoid multiple returns
(unsigned) res >= len also catches negative res (for any reason) as bigger than len
and some comment cleanup (the old one sound like the package is unreceived (and might be still receivable)

[kfessel]

not sure if this helps with the ping issue but if not i don't think the original one helped either

[benpicco]

Ah the adaptive ping issue is unrelated. I was testing this on a nrf52840dk with examples/gnrc_border_router, so gnrc_netif_pktq is used

> ping ff02::1
error: packet buffer full
error: packet buffer full
error: packet buffer full

-> #17924

[benpicco]

closed in favor of #18826