|
 |
56e3f4 |
From 5e753fef71954c833fa859b2e48e57874500a2fd Mon Sep 17 00:00:00 2001
|
|
|
56e3f4 |
From: =?UTF-8?q?=C3=8D=C3=B1igo=20Huguet?= <ihuguet@redhat.com>
|
|
|
56e3f4 |
Date: Fri, 21 Jan 2022 08:49:03 +0100
|
|
|
56e3f4 |
Subject: [PATCH 17/36] rtw89: fix potentially access out of range of RF
|
|
|
56e3f4 |
register array
|
|
|
56e3f4 |
MIME-Version: 1.0
|
|
|
56e3f4 |
Content-Type: text/plain; charset=UTF-8
|
|
|
56e3f4 |
Content-Transfer-Encoding: 8bit
|
|
|
56e3f4 |
|
|
|
56e3f4 |
Bugzilla: http://bugzilla.redhat.com/2033291
|
|
|
56e3f4 |
|
|
|
56e3f4 |
commit 30101812a09b37bc8aa409a83f603d4c072198f2
|
|
|
56e3f4 |
Author: Ping-Ke Shih <pkshih@realtek.com>
|
|
|
56e3f4 |
Date: Fri Nov 19 13:57:29 2021 +0800
|
|
|
56e3f4 |
|
|
|
56e3f4 |
rtw89: fix potentially access out of range of RF register array
|
|
|
56e3f4 |
|
|
|
56e3f4 |
The RF register array is used to help firmware to restore RF settings.
|
|
|
56e3f4 |
The original code can potentially access out of range, if the size is
|
|
|
56e3f4 |
between (RTW89_H2C_RF_PAGE_SIZE * RTW89_H2C_RF_PAGE_NUM + 1) to
|
|
|
56e3f4 |
((RTW89_H2C_RF_PAGE_SIZE + 1) * RTW89_H2C_RF_PAGE_NUM). Fortunately,
|
|
|
56e3f4 |
current used size doesn't fall into the wrong case, and the size will not
|
|
|
56e3f4 |
change if we don't update RF parameter.
|
|
|
56e3f4 |
|
|
|
56e3f4 |
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
|
|
|
56e3f4 |
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
|
|
|
56e3f4 |
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
|
|
56e3f4 |
Link: https://lore.kernel.org/r/20211119055729.12826-1-pkshih@realtek.com
|
|
|
56e3f4 |
|
|
|
56e3f4 |
Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
|
|
|
56e3f4 |
---
|
|
|
56e3f4 |
drivers/net/wireless/realtek/rtw89/phy.c | 33 ++++++++++++++++++--------------
|
|
|
56e3f4 |
1 file changed, 19 insertions(+), 14 deletions(-)
|
|
|
56e3f4 |
|
|
|
56e3f4 |
diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
|
|
|
56e3f4 |
index abb4cdcd03e7..312d9a07599d 100644
|
|
|
56e3f4 |
--- a/drivers/net/wireless/realtek/rtw89/phy.c
|
|
|
56e3f4 |
+++ b/drivers/net/wireless/realtek/rtw89/phy.c
|
|
|
56e3f4 |
@@ -654,6 +654,12 @@ rtw89_phy_cofig_rf_reg_store(struct rtw89_dev *rtwdev,
|
|
|
56e3f4 |
u16 idx = info->curr_idx % RTW89_H2C_RF_PAGE_SIZE;
|
|
|
56e3f4 |
u8 page = info->curr_idx / RTW89_H2C_RF_PAGE_SIZE;
|
|
|
56e3f4 |
|
|
|
56e3f4 |
+ if (page >= RTW89_H2C_RF_PAGE_NUM) {
|
|
|
56e3f4 |
+ rtw89_warn(rtwdev, "RF parameters exceed size. path=%d, idx=%d",
|
|
|
56e3f4 |
+ rf_path, info->curr_idx);
|
|
|
56e3f4 |
+ return;
|
|
|
56e3f4 |
+ }
|
|
|
56e3f4 |
+
|
|
|
56e3f4 |
info->rtw89_phy_config_rf_h2c[page][idx] =
|
|
|
56e3f4 |
cpu_to_le32((reg->addr << 20) | reg->data);
|
|
|
56e3f4 |
info->curr_idx++;
|
|
|
56e3f4 |
@@ -662,30 +668,29 @@ rtw89_phy_cofig_rf_reg_store(struct rtw89_dev *rtwdev,
|
|
|
56e3f4 |
static int rtw89_phy_config_rf_reg_fw(struct rtw89_dev *rtwdev,
|
|
|
56e3f4 |
struct rtw89_fw_h2c_rf_reg_info *info)
|
|
|
56e3f4 |
{
|
|
|
56e3f4 |
- u16 page = info->curr_idx / RTW89_H2C_RF_PAGE_SIZE;
|
|
|
56e3f4 |
- u16 len = (info->curr_idx % RTW89_H2C_RF_PAGE_SIZE) * 4;
|
|
|
56e3f4 |
+ u16 remain = info->curr_idx;
|
|
|
56e3f4 |
+ u16 len = 0;
|
|
|
56e3f4 |
u8 i;
|
|
|
56e3f4 |
int ret = 0;
|
|
|
56e3f4 |
|
|
|
56e3f4 |
- if (page > RTW89_H2C_RF_PAGE_NUM) {
|
|
|
56e3f4 |
+ if (remain > RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE) {
|
|
|
56e3f4 |
rtw89_warn(rtwdev,
|
|
|
56e3f4 |
- "rf reg h2c total page num %d larger than %d (RTW89_H2C_RF_PAGE_NUM)\n",
|
|
|
56e3f4 |
- page, RTW89_H2C_RF_PAGE_NUM);
|
|
|
56e3f4 |
- return -EINVAL;
|
|
|
56e3f4 |
+ "rf reg h2c total len %d larger than %d\n",
|
|
|
56e3f4 |
+ remain, RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE);
|
|
|
56e3f4 |
+ ret = -EINVAL;
|
|
|
56e3f4 |
+ goto out;
|
|
|
56e3f4 |
}
|
|
|
56e3f4 |
|
|
|
56e3f4 |
- for (i = 0; i < page; i++) {
|
|
|
56e3f4 |
- ret = rtw89_fw_h2c_rf_reg(rtwdev, info,
|
|
|
56e3f4 |
- RTW89_H2C_RF_PAGE_SIZE * 4, i);
|
|
|
56e3f4 |
+ for (i = 0; i < RTW89_H2C_RF_PAGE_NUM && remain; i++, remain -= len) {
|
|
|
56e3f4 |
+ len = remain > RTW89_H2C_RF_PAGE_SIZE ? RTW89_H2C_RF_PAGE_SIZE : remain;
|
|
|
56e3f4 |
+ ret = rtw89_fw_h2c_rf_reg(rtwdev, info, len * 4, i);
|
|
|
56e3f4 |
if (ret)
|
|
|
56e3f4 |
- return ret;
|
|
|
56e3f4 |
+ goto out;
|
|
|
56e3f4 |
}
|
|
|
56e3f4 |
- ret = rtw89_fw_h2c_rf_reg(rtwdev, info, len, i);
|
|
|
56e3f4 |
- if (ret)
|
|
|
56e3f4 |
- return ret;
|
|
|
56e3f4 |
+out:
|
|
|
56e3f4 |
info->curr_idx = 0;
|
|
|
56e3f4 |
|
|
|
56e3f4 |
- return 0;
|
|
|
56e3f4 |
+ return ret;
|
|
|
56e3f4 |
}
|
|
|
56e3f4 |
|
|
|
56e3f4 |
static void rtw89_phy_config_rf_reg(struct rtw89_dev *rtwdev,
|
|
|
56e3f4 |
--
|
|
|
56e3f4 |
2.13.6
|
|
|
56e3f4 |
|