Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 10c0f2a8 authored by Rajesh K Borundia's avatar Rajesh K Borundia Committed by David S. Miller
Browse files

netxen: validate unified romimage 



Signed-off-by: default avatarRajesh K Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: default avatarAmit Kumar Salecha <amit.salecha@qlogic.com>

Validate all sections of unified romimage, before accessing them,
  to avoid seg fault.

Signed-off-by: default avatarAmit Kumar Salecha <amit.salecha@qlogic.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6b50ea15

drivers/net/netxen/netxen_nic.h

+0 −1
Original line number Diff line number Diff line
@@ -420,7 +420,6 @@ struct status_desc { 
} __attribute__ ((aligned(16)));



/* UNIFIED ROMIMAGE *************************/

#define NX_UNI_FW_MIN_SIZE		0xc8000

#define NX_UNI_DIR_SECT_PRODUCT_TBL	0x0

#define NX_UNI_DIR_SECT_BOOTLD		0x6

#define NX_UNI_DIR_SECT_FW		0x7

drivers/net/netxen/netxen_nic_init.c

+140 −14
Original line number Diff line number Diff line
@@ -613,22 +613,123 @@ static struct uni_table_desc *nx_get_table_desc(const u8 *unirom, int section) 
	return NULL;

}



#define	QLCNIC_FILEHEADER_SIZE	(14 * 4)



static int

nx_set_product_offs(struct netxen_adapter *adapter)

netxen_nic_validate_header(struct netxen_adapter *adapter)

 {

	struct uni_table_desc *ptab_descr;

	const u8 *unirom = adapter->fw->data;

	uint32_t i;

	struct uni_table_desc *directory = (struct uni_table_desc *) &unirom[0];

	u32 fw_file_size = adapter->fw->size;

	u32 tab_size;

	__le32 entries;

	__le32 entry_size;



	if (fw_file_size < QLCNIC_FILEHEADER_SIZE)

		return -EINVAL;



	entries = cpu_to_le32(directory->num_entries);

	entry_size = cpu_to_le32(directory->entry_size);

	tab_size = cpu_to_le32(directory->findex) + (entries * entry_size);



	if (fw_file_size < tab_size)

		return -EINVAL;



	return 0;

}



static int

netxen_nic_validate_bootld(struct netxen_adapter *adapter)

{

	struct uni_table_desc *tab_desc;

	struct uni_data_desc *descr;

	const u8 *unirom = adapter->fw->data;

	__le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +

				NX_UNI_BOOTLD_IDX_OFF));

	u32 offs;

	u32 tab_size;

	u32 data_size;



	tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_BOOTLD);



	if (!tab_desc)

		return -EINVAL;



	tab_size = cpu_to_le32(tab_desc->findex) +

			(cpu_to_le32(tab_desc->entry_size) * (idx + 1));



	if (adapter->fw->size < tab_size)

		return -EINVAL;



	offs = cpu_to_le32(tab_desc->findex) +

		(cpu_to_le32(tab_desc->entry_size) * (idx));

	descr = (struct uni_data_desc *)&unirom[offs];



	data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);



	if (adapter->fw->size < data_size)

		return -EINVAL;



	return 0;

}



static int

netxen_nic_validate_fw(struct netxen_adapter *adapter)

{

	struct uni_table_desc *tab_desc;

	struct uni_data_desc *descr;

	const u8 *unirom = adapter->fw->data;

	__le32 idx = cpu_to_le32(*((int *)&unirom[adapter->file_prd_off] +

				NX_UNI_FIRMWARE_IDX_OFF));

	u32 offs;

	u32 tab_size;

	u32 data_size;



	tab_desc = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_FW);



	if (!tab_desc)

		return -EINVAL;



	tab_size = cpu_to_le32(tab_desc->findex) +

			(cpu_to_le32(tab_desc->entry_size) * (idx + 1));



	if (adapter->fw->size < tab_size)

		return -EINVAL;



	offs = cpu_to_le32(tab_desc->findex) +

		(cpu_to_le32(tab_desc->entry_size) * (idx));

	descr = (struct uni_data_desc *)&unirom[offs];

	data_size = cpu_to_le32(descr->findex) + cpu_to_le32(descr->size);



	if (adapter->fw->size < data_size)

		return -EINVAL;



	return 0;

}





static int

netxen_nic_validate_product_offs(struct netxen_adapter *adapter)

{

	struct uni_table_desc *ptab_descr;

	const u8 *unirom = adapter->fw->data;

	int mn_present = (NX_IS_REVISION_P2(adapter->ahw.revision_id)) ?

			1 : netxen_p3_has_mn(adapter);

	__le32 entries;

	__le32 entry_size;

	u32 tab_size;

	u32 i;



	ptab_descr = nx_get_table_desc(unirom, NX_UNI_DIR_SECT_PRODUCT_TBL);

	if (ptab_descr == NULL)

		return -1;

		return -EINVAL;



	entries = cpu_to_le32(ptab_descr->num_entries);

	entry_size = cpu_to_le32(ptab_descr->entry_size);

	tab_size = cpu_to_le32(ptab_descr->findex) + (entries * entry_size);



	if (adapter->fw->size < tab_size)

		return -EINVAL;



nomn:

	for (i = 0; i < entries; i++) {
@@ -657,9 +758,38 @@ nx_set_product_offs(struct netxen_adapter *adapter) 
		goto nomn;

	}



	return -1;

	return -EINVAL;

}



static int

netxen_nic_validate_unified_romimage(struct netxen_adapter *adapter)

{

	if (netxen_nic_validate_header(adapter)) {

		dev_err(&adapter->pdev->dev,

				"unified image: header validation failed\n");

		return -EINVAL;

	}



	if (netxen_nic_validate_product_offs(adapter)) {

		dev_err(&adapter->pdev->dev,

				"unified image: product validation failed\n");

		return -EINVAL;

	}



	if (netxen_nic_validate_bootld(adapter)) {

		dev_err(&adapter->pdev->dev,

				"unified image: bootld validation failed\n");

		return -EINVAL;

	}



	if (netxen_nic_validate_fw(adapter)) {

		dev_err(&adapter->pdev->dev,

				"unified image: firmware validation failed\n");

		return -EINVAL;

	}



	return 0;

}



static struct uni_data_desc *nx_get_data_desc(struct netxen_adapter *adapter,

			u32 section, u32 idx_offset)
@@ -933,26 +1063,22 @@ static int 
netxen_validate_firmware(struct netxen_adapter *adapter)

{

	__le32 val;

	u32 ver, min_ver, bios, min_size;

	u32 ver, min_ver, bios;

	struct pci_dev *pdev = adapter->pdev;

	const struct firmware *fw = adapter->fw;

	u8 fw_type = adapter->fw_type;



	if (fw_type == NX_UNIFIED_ROMIMAGE) {

		if (nx_set_product_offs(adapter))

		if (netxen_nic_validate_unified_romimage(adapter))

			return -EINVAL;



		min_size = NX_UNI_FW_MIN_SIZE;

	} else {

		val = cpu_to_le32(*(u32 *)&fw->data[NX_FW_MAGIC_OFFSET]);

		if ((__force u32)val != NETXEN_BDINFO_MAGIC)

			return -EINVAL;



		min_size = NX_FW_MIN_SIZE;

	}



	if (fw->size < min_size)

		if (fw->size < NX_FW_MIN_SIZE)

			return -EINVAL;

	}



	val = nx_get_fw_version(adapter);