Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

iwlwifi: add range checking in tm sram read command

Browse source 
The size of sram may alter according to ucode type.
Retrieve the maximum sram size by current ucode
type for range checking to prevent wrong data access.

Signed-off-by: Kenny Hsu <kenny.hsu@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
This commit is contained in:
Kenny Hsu 2011-11-23 06:57:22 -08:00 committed by Wey-Yi Guy
parent 306713fd1a
commit 76de2f29d4
1 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
drivers/net/wireless/iwlwifi/iwl-sv-open.c
View file

@ -680,7 +680,7 @@ static int iwl_testmode_ownership(struct ieee80211_hw *hw, struct nlattr **tb)
static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb) static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
{ {
struct iwl_priv *priv = hw->priv; struct iwl_priv *priv = hw->priv;
u32 base, ofs, size; u32 base, ofs, size, maxsize;
if (priv->testmode_sram.sram_readed) if (priv->testmode_sram.sram_readed)
return -EBUSY; return -EBUSY;
@ -695,6 +695,27 @@ static int iwl_testmode_sram(struct ieee80211_hw *hw, struct nlattr **tb)
return -ENOMSG; return -ENOMSG;
} }
size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]); size = nla_get_u32(tb[IWL_TM_ATTR_SRAM_SIZE]);
switch (priv->ucode_type) {
case IWL_UCODE_REGULAR:
maxsize = trans(priv)->ucode_rt.data.len;
break;
case IWL_UCODE_INIT:
maxsize = trans(priv)->ucode_init.data.len;
break;
case IWL_UCODE_WOWLAN:
maxsize = trans(priv)->ucode_wowlan.data.len;
break;
case IWL_UCODE_NONE:
IWL_DEBUG_INFO(priv, "Error, uCode does not been loaded\n");
return -ENOSYS;
default:
IWL_DEBUG_INFO(priv, "Error, unsupported uCode type\n");
return -ENOSYS;
}
if ((ofs + size) > maxsize) {
IWL_DEBUG_INFO(priv, "Invalid offset/size: out of range\n");
return -EINVAL;
}
priv->testmode_sram.buff_size = (size / 4) * 4; priv->testmode_sram.buff_size = (size / 4) * 4;
priv->testmode_sram.buff_addr = priv->testmode_sram.buff_addr =
kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL); kmalloc(priv->testmode_sram.buff_size, GFP_KERNEL);