From 10d472d8a660e33d63a04d001f683c4463268675 Mon Sep 17 00:00:00 2001 From: d00f Date: Sat, 8 Aug 2026 17:13:28 +0200 Subject: [PATCH] vlan: reject VLAN IDs the table cannot hold vlan_create() and vlan_delete() wrote the ID straight into the table index register. vlan_get() has refused anything >= 0xfff for a while, so reads were guarded and writes were not: "vlan 4095 1 2" built an entry that no read path can see, and IDs above that either miss the table or alias onto another VLAN. Both writers now enforce the range vlan_get() already did, and parse_vlan() rejects the same values with the usage message so the CLI says why. The check sits after the "vlan 0 mgmt" branch, which legitimately takes 0 to switch the management VLAN off. Costs nothing in RAM: rtl837x_port.rel stays at DSEG 0, OSEG 5, and the image still reports 10207 bytes of XDATA in use. --- cmd_parser.c | 2 ++ rtl837x_port.c | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/cmd_parser.c b/cmd_parser.c index 88e39f2..bc6a8bd 100644 --- a/cmd_parser.c +++ b/cmd_parser.c @@ -354,6 +354,8 @@ void parse_vlan(void) print_string("Management VLAN set to "); print_short(management_vlan); write_char('\n'); return; } + if (!vlan_settings.vlan || vlan_settings.vlan > 4094) + goto err; uint8_t w = 2; if (cmd_words_len > w && isletter(cmd_buffer[cmd_words_b[w]])) { register uint8_t i = 0; diff --git a/rtl837x_port.c b/rtl837x_port.c index c540ac3..d203e12 100644 --- a/rtl837x_port.c +++ b/rtl837x_port.c @@ -115,6 +115,9 @@ uint16_t port_pvid_get(uint8_t port) __banked void vlan_delete(uint16_t vlan) __banked { + if (!vlan || vlan >= 0xfff) + return; + print_string("\nvlan_delete called \n"); print_short(vlan); vlan_name_remove(vlan); REG_WRITE(RTL837x_TBL_DATA_IN_A, 0, 0, 0, 0); @@ -197,6 +200,11 @@ __xdata uint16_t vlan_name(register uint16_t vlan) __banked */ void vlan_create(void) __banked { + if (!vlan_settings.vlan || vlan_settings.vlan >= 0xfff) { + print_string("\nInvalid VLAN: "); print_short(vlan_settings.vlan); write_char('\n'); + return; + } + // For now, the CPU-port is always a tagged member: vlan_settings.members |= 0x0200; // Set 10th bit vlan_settings.tagged |= 0x0200;