Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c361efb authored by Francois Romieu's avatar Francois Romieu
Browse files

r8169: explicit firmware format check. 



Signed-off-by: default avatarFrancois Romieu <romieu@fr.zoreil.com>
parent b6ffd97f

drivers/net/r8169.c

+49 −13
Original line number Diff line number Diff line
@@ -669,6 +669,15 @@ struct rtl8169_private { 


	struct rtl_fw {

		const struct firmware *fw;



#define RTL_VER_SIZE		32



		char version[RTL_VER_SIZE];



		struct rtl_fw_phy_action {

			__le32 *code;

			size_t size;

		} phy_action;

	} *rtl_fw;

#define RTL_FIRMWARE_UNKNOWN	ERR_PTR(-EAGAIN);

};
@@ -1229,8 +1238,9 @@ static void rtl8169_get_drvinfo(struct net_device *dev, 
	strcpy(info->driver, MODULENAME);

	strcpy(info->version, RTL8169_VERSION);

	strcpy(info->bus_info, pci_name(tp->pci_dev));

	strncpy(info->fw_version, IS_ERR_OR_NULL(rtl_fw) ? "N/A" :

		rtl_lookup_firmware_name(tp), sizeof(info->fw_version) - 1);

	BUILD_BUG_ON(sizeof(info->fw_version) < sizeof(rtl_fw->version));

	strcpy(info->fw_version, IS_ERR_OR_NULL(rtl_fw) ? "N/A" :

	       rtl_fw->version);

}



static int rtl8169_get_regs_len(struct net_device *dev)
@@ -1744,21 +1754,47 @@ static void rtl_writephy_batch(struct rtl8169_private *tp, 
#define PHY_DELAY_MS		0xe0000000

#define PHY_WRITE_ERI_WORD	0xf0000000



static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)

#define FW_OPCODE_SIZE	sizeof(typeof(*((struct rtl_fw_phy_action *)0)->code))



static bool rtl_fw_format_ok(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)

{

	const struct firmware *fw = rtl_fw->fw;

	__le32 *phytable = (__le32 *)fw->data;

	struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;

	char *version = rtl_fw->version;

	bool rc = false;



	if (fw->size < FW_OPCODE_SIZE)

		goto out;

	else {

		if (fw->size % FW_OPCODE_SIZE)

			goto out;



		strlcpy(version, rtl_lookup_firmware_name(tp), RTL_VER_SIZE);



		pa->code = (__le32 *)fw->data;

		pa->size = fw->size / FW_OPCODE_SIZE;

	}

	version[RTL_VER_SIZE - 1] = 0;



	rc = true;

out:

	return rc;

}



static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)

{

	struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;

	struct net_device *dev = tp->dev;

	size_t index, fw_size = fw->size / sizeof(*phytable);

	u32 predata, count;

	size_t index;



	if (fw->size % sizeof(*phytable)) {

		netif_err(tp, probe, dev, "odd sized firmware %zd\n", fw->size);

	if (!rtl_fw_format_ok(tp, rtl_fw)) {

		netif_err(tp, probe, dev, "invalid firwmare\n");

		return;

	}



	for (index = 0; index < fw_size; index++) {

		u32 action = le32_to_cpu(phytable[index]);

	for (index = 0; index < pa->size; index++) {

		u32 action = le32_to_cpu(pa->code[index]);

		u32 regno = (action & 0x0fff0000) >> 16;



		switch(action & 0xf0000000) {
@@ -1780,7 +1816,7 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw) 
			}

			break;

		case PHY_READCOUNT_EQ_SKIP:

			if (index + 2 >= fw_size) {

			if (index + 2 >= pa->size) {

				netif_err(tp, probe, tp->dev,

					  "Out of range of firmware\n");

				return;
@@ -1789,7 +1825,7 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw) 
		case PHY_COMP_EQ_SKIPN:

		case PHY_COMP_NEQ_SKIPN:

		case PHY_SKIPN:

			if (index + 1 + regno >= fw_size) {

			if (index + 1 + regno >= pa->size) {

				netif_err(tp, probe, tp->dev,

					  "Out of range of firmware\n");

				return;
@@ -1809,8 +1845,8 @@ static void rtl_phy_write_fw(struct rtl8169_private *tp, struct rtl_fw *rtl_fw) 
	predata = 0;

	count = 0;



	for (index = 0; index < fw_size; ) {

		u32 action = le32_to_cpu(phytable[index]);

	for (index = 0; index < pa->size; ) {

		u32 action = le32_to_cpu(pa->code[index]);

		u32 data = action & 0x0000ffff;

		u32 regno = (action & 0x0fff0000) >> 16;