Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Michael Straube <straube.linux@gmail.com>
To:     gregkh@linuxfoundation.org
Cc:     Larry.Finger@lwfinger.net, phil@philpotter.co.uk,
        linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org,
        Michael Straube <straube.linux@gmail.com>
Subject: [PATCH v3 1/8] staging: r8188eu: fix struct rt_firmware_hdr
Date:   Fri, 15 Apr 2022 14:10:16 +0200
Message-Id: <20220415121023.11564-2-straube.linux@gmail.com>
In-Reply-To: <20220415121023.11564-1-straube.linux@gmail.com>
References: <20220415121023.11564-1-straube.linux@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

The size of struct rt_firmware_hdr is 36 bytes.

$ pahole -C rt_firmware_hdr drivers/staging/r8188eu/r8188eu.o
struct rt_firmware_hdr {
        __le16                     Signature;            /*     0     2 */
        u8                         Category;             /*     2     1 */
        u8                         Function;             /*     3     1 */
        __le16                     Version;              /*     4     2 */
        u8                         Subversion;           /*     6     1 */

        /* XXX 1 byte hole, try to pack */

        u16                        Rsvd1;                /*     8     2 */
        u8                         Month;                /*    10     1 */
        u8                         Date;                 /*    11     1 */
        u8                         Hour;                 /*    12     1 */
        u8                         Minute;               /*    13     1 */
        __le16                     RamCodeSize;          /*    14     2 */
        u8                         Foundry;              /*    16     1 */
        u8                         Rsvd2;                /*    17     1 */

        /* XXX 2 bytes hole, try to pack */

        __le32                     SvnIdx;               /*    20     4 */
        u32                        Rsvd3;                /*    24     4 */
        u32                        Rsvd4;                /*    28     4 */
        u32                        Rsvd5;                /*    32     4 */

        /* size: 36, cachelines: 1, members: 17 */
        /* sum members: 33, holes: 2, sum holes: 3 */
        /* last cacheline: 36 bytes */
};

But the header in the firmware file is only 32 bytes long.

The hexdump of rtl8188eufw.bin shows that the field Rsvd1 should be u8
instead of __le16.

OFFSET      rtl8188eufw.bin
-----------------------------------------------------------
0x00000000  E1 88 10 00 0B 00 01 00 01 21 11 27 30 36 00 00
0x00000010  2D 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0x00000000  E1 88 10 00 0B 00 01  00     01     21    11    27 30 36 00 00
                              ^   ^      ^      ^     ^     ^
                     Subversion   Rsvd1  Month  Date  Hour  Minute

With the change of field Rsvd1 from __le16 to u8 the structure has the
correct size 32.

$ pahole -C rt_firmware_hdr drivers/staging/r8188eu/r8188eu.o
struct rt_firmware_hdr {
        __le16                     Signature;            /*     0     2 */
        u8                         Category;             /*     2     1 */
        u8                         Function;             /*     3     1 */
        __le16                     Version;              /*     4     2 */
        u8                         Subversion;           /*     6     1 */
        u8                         Rsvd1;                /*     7     1 */
        u8                         Month;                /*     8     1 */
        u8                         Date;                 /*     9     1 */
        u8                         Hour;                 /*    10     1 */
        u8                         Minute;               /*    11     1 */
        __le16                     RamCodeSize;          /*    12     2 */
        u8                         Foundry;              /*    14     1 */
        u8                         Rsvd2;                /*    15     1 */
        __le32                     SvnIdx;               /*    16     4 */
        u32                        Rsvd3;                /*    20     4 */
        u32                        Rsvd4;                /*    24     4 */
        u32                        Rsvd5;                /*    28     4 */

        /* size: 32, cachelines: 1, members: 17 */
        /* last cacheline: 32 bytes */

The wrong size had no effect because the header size is hardcoded to
32 where it is used in the code and the fields after Subversion are
not used.

Fixes: 7884fc0a1473 ("staging: r8188eu: introduce new include dir for RTL8188eu driver")
Signed-off-by: Michael Straube <straube.linux@gmail.com>
---
v3:
- updated the commit message
- moved the u32 to __le32 conversions to a separate patch

v2:
- no changes

 drivers/staging/r8188eu/core/rtw_fw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/r8188eu/core/rtw_fw.c b/drivers/staging/r8188eu/core/rtw_fw.c
index 8620f3c92b52..eb4ab11f6b28 100644
--- a/drivers/staging/r8188eu/core/rtw_fw.c
+++ b/drivers/staging/r8188eu/core/rtw_fw.c
@@ -29,7 +29,7 @@ struct rt_firmware_hdr {
 					 *  FW for different conditions */
 	__le16		Version;	/*  FW Version */
 	u8		Subversion;	/*  FW Subversion, default 0x00 */
-	u16		Rsvd1;
+	u8		Rsvd1;
 
 	/*  LONG WORD 1 ---- */
 	u8		Month;	/*  Release time Month field */
-- 
2.35.1