AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-02 18:56:44 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

wl1271: Fix overflow in wl1271_boot_upload_nvs

Browse Source 
Due to miscalculation of nvs_len, excessive data was sent to the
firmware.
Fix this by first setting nvs_ptr to point to the first NVS table,
and computing the total size of all NVS tables accordingly.

Signed-off-by: Ido Yariv <ido@wizery.com>
Tested-By: Tuomas Katila <ext-tuomas.2.katila@nokia.com>
Acked-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Ido Yariv 2010-09-22 09:53:13 +02:00 committed by John W. Linville
parent 87fd2e6c90
commit 67e0208ace
1 changed files with 6 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/net/wireless/wl12xx/wl1271_boot.c
View File

@ -274,11 +274,11 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
/*
* We've reached the first zero length, the first NVS table
* is 7 bytes further.
* is located at an aligned offset which is at least 7 bytes further.
*/
nvs_ptr += 7;
nvs_ptr = (u8 *)wl->nvs->nvs +
ALIGN(nvs_ptr - (u8 *)wl->nvs->nvs + 7, 4);
nvs_len -= nvs_ptr - (u8 *)wl->nvs->nvs;
nvs_len = ALIGN(nvs_len, 4);
/* FIXME: The driver sets the partition here, but this is not needed,
since it sets to the same one as currently in use */
@ -286,14 +286,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
wl1271_set_partition(wl, &part_table[PART_WORK]);
/* Copy the NVS tables to a new block to ensure alignment */
/* FIXME: We jump 3 more bytes before uploading the NVS. It seems
that our NVS files have three extra zeros here. I'm not sure whether
the problem is in our NVS generation or we should really jumpt these
3 bytes here */
nvs_ptr += 3;
nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL); if
(!nvs_aligned) return -ENOMEM;
nvs_aligned = kmemdup(nvs_ptr, nvs_len, GFP_KERNEL);
if (!nvs_aligned)
return -ENOMEM;
/* And finally we upload the NVS tables */
/* FIXME: In wl1271, we upload everything at once.