Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757167Ab2BHVpV (ORCPT ); Wed, 8 Feb 2012 16:45:21 -0500 Received: from exchange.solarflare.com ([216.237.3.220]:7303 "EHLO ocex02.SolarFlarecom.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1750813Ab2BHVpS (ORCPT ); Wed, 8 Feb 2012 16:45:18 -0500 Message-ID: <1328737514.2627.14.camel@bwh-desktop> Subject: Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer From: Ben Hutchings To: Tim Gardner CC: , Chaoming Li , "John W. Linville" , , , Date: Wed, 8 Feb 2012 21:45:14 +0000 In-Reply-To: <1328735291-33220-1-git-send-email-tim.gardner@canonical.com> References: <1328735291-33220-1-git-send-email-tim.gardner@canonical.com> Organization: Solarflare Communications Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.2 (3.2.2-1.fc16) Content-Transfer-Encoding: 7bit MIME-Version: 1.0 X-Originating-IP: [10.17.20.137] X-TM-AS-Product-Ver: SMEX-10.0.0.1412-6.800.1017-18696.005 X-TM-AS-Result: No--17.569200-0.000000-31 X-TM-AS-User-Approved-Sender: Yes X-TM-AS-User-Blocked-Sender: No Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2619 Lines: 68 On Wed, 2012-02-08 at 14:08 -0700, Tim Gardner wrote: > The firmware file size check does not use the > correct limit. > > Cc: Larry Finger > Cc: Chaoming Li > Cc: John W. Linville > Cc: linux-wireless@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Signed-off-by: Tim Gardner > --- > drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- > drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- > 2 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > index babe85d..5c377fc 100644 > --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > @@ -30,6 +30,7 @@ > #define __REALTEK_FIRMWARE92S_H__ > > #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 > +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 > #define RTL8190_CPU_START_OFFSET 0x80 > /* Firmware Local buffer size. 64k */ > #define MAX_FIRMWARE_CODE_SIZE 0xFF00 > @@ -217,7 +218,7 @@ struct rt_firmware { > u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; > u32 fw_imem_len; > u32 fw_emem_len; > - u8 sz_fw_tmpbuffer[164000]; > + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; > u32 sz_fw_tmpbufferlen; > u16 cmdpacket_fragthresold; > }; > diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > index ca38dd9..155da0a 100644 > --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) > rtlpriv->max_fw_size = 0; > return; > } > - if (firmware->size > rtlpriv->max_fw_size) { > + if (firmware->size >= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { This appears to reject a firmware blob which is exactly the maximum size, which looks wrong. Also doesn't this make the max_fw_size field redundant? Ben. > RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, > "Firmware is too big!\n"); > release_firmware(firmware); -- Ben Hutchings, Staff Engineer, Solarflare Not speaking for my employer; that's the marketing department's job. They asked us to note that Solarflare product names are trademarked. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/