diff options
Diffstat (limited to 'drivers/staging/bcm/nvm.c')
| -rw-r--r-- | drivers/staging/bcm/nvm.c | 110 |
1 files changed, 29 insertions, 81 deletions
diff --git a/drivers/staging/bcm/nvm.c b/drivers/staging/bcm/nvm.c index 9e5f955a1a0..63be3be62eb 100644 --- a/drivers/staging/bcm/nvm.c +++ b/drivers/staging/bcm/nvm.c @@ -122,7 +122,7 @@ static UCHAR ReadEEPROMStatusRegister(struct bcm_mini_adapter *Adapter) * OSAL_STATUS_CODE: */ -int ReadBeceemEEPROMBulk(struct bcm_mini_adapter *Adapter, +static int ReadBeceemEEPROMBulk(struct bcm_mini_adapter *Adapter, DWORD dwAddress, DWORD *pdwData, DWORD dwNumWords) @@ -1355,67 +1355,6 @@ BeceemFlashBulkWriteStatus_EXIT: } /* - * Procedure: PropagateCalParamsFromEEPROMToMemory - * - * Description: Dumps the calibration section of EEPROM to DDR. - * - * Arguments: - * Adapter - ptr to Adapter object instance - * Returns: - * OSAL_STATUS_CODE - * - */ - -int PropagateCalParamsFromEEPROMToMemory(struct bcm_mini_adapter *Adapter) -{ - PCHAR pBuff = kmalloc(BUFFER_4K, GFP_KERNEL); - unsigned int uiEepromSize = 0; - unsigned int uiIndex = 0; - unsigned int uiBytesToCopy = 0; - unsigned int uiCalStartAddr = EEPROM_CALPARAM_START; - unsigned int uiMemoryLoc = EEPROM_CAL_DATA_INTERNAL_LOC; - unsigned int value; - int Status = 0; - - if (!pBuff) - return -ENOMEM; - - if (0 != BeceemEEPROMBulkRead(Adapter, &uiEepromSize, EEPROM_SIZE_OFFSET, 4)) { - kfree(pBuff); - return -1; - } - - uiEepromSize >>= 16; - if (uiEepromSize > 1024 * 1024) { - kfree(pBuff); - return -1; - } - - uiBytesToCopy = MIN(BUFFER_4K, uiEepromSize); - - while (uiBytesToCopy) { - if (0 != BeceemEEPROMBulkRead(Adapter, (PUINT)pBuff, uiCalStartAddr, uiBytesToCopy)) { - Status = -1; - break; - } - wrm(Adapter, uiMemoryLoc, (PCHAR)(((PULONG)pBuff) + uiIndex), uiBytesToCopy); - uiMemoryLoc += uiBytesToCopy; - uiEepromSize -= uiBytesToCopy; - uiCalStartAddr += uiBytesToCopy; - uiIndex += uiBytesToCopy / 4; - uiBytesToCopy = MIN(BUFFER_4K, uiEepromSize); - - } - value = 0xbeadbead; - wrmalt(Adapter, EEPROM_CAL_DATA_INTERNAL_LOC - 4, &value, sizeof(value)); - value = 0xbeadbead; - wrmalt(Adapter, EEPROM_CAL_DATA_INTERNAL_LOC - 8, &value, sizeof(value)); - kfree(pBuff); - - return Status; -} - -/* * Procedure: PropagateCalParamsFromFlashToMemory * * Description: Dumps the calibration section of EEPROM to DDR. @@ -2759,7 +2698,7 @@ int BcmGetSectionValStartOffset(struct bcm_mini_adapter *Adapter, enum bcm_flash * On Failure -returns STATUS_FAILURE */ -int BcmGetSectionValEndOffset(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val eFlash2xSectionVal) +static int BcmGetSectionValEndOffset(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val eFlash2xSectionVal) { int SectEndOffset = 0; @@ -2873,7 +2812,7 @@ int BcmFlash2xBulkRead(struct bcm_mini_adapter *Adapter, SectionStartOffset = BcmGetSectionValStartOffset(Adapter, eFlash2xSectionVal); if (SectionStartOffset == STATUS_FAILURE) { - BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "This Section<%d> does not exixt in Flash 2.x Map ", eFlash2xSectionVal); + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "This Section<%d> does not exist in Flash 2.x Map ", eFlash2xSectionVal); return -EINVAL; } @@ -2936,7 +2875,7 @@ int BcmFlash2xBulkWrite(struct bcm_mini_adapter *Adapter, FlashSectValStartOffset = BcmGetSectionValStartOffset(Adapter, eFlash2xSectVal); if (FlashSectValStartOffset == STATUS_FAILURE) { - BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "This Section<%d> does not exixt in Flash Map 2.x", eFlash2xSectVal); + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "This Section<%d> does not exist in Flash Map 2.x", eFlash2xSectVal); return -EINVAL; } @@ -3041,7 +2980,7 @@ static int BcmGetActiveISO(struct bcm_mini_adapter *Adapter) * */ -B_UINT8 IsOffsetWritable(struct bcm_mini_adapter *Adapter, unsigned int uiOffset) +static B_UINT8 IsOffsetWritable(struct bcm_mini_adapter *Adapter, unsigned int uiOffset) { unsigned int uiSectorNum = 0; unsigned int uiWordOfSectorPermission = 0; @@ -3435,7 +3374,7 @@ int BcmSetActiveSection(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_secti case DSD2: if (ReadDSDSignature(Adapter, eFlash2xSectVal) == DSD_IMAGE_MAGIC_NUMBER) { HighestPriDSD = getHighestPriDSD(Adapter); - if ((HighestPriDSD == eFlash2xSectVal)) { + if (HighestPriDSD == eFlash2xSectVal) { BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, NVM_RW, DBG_LVL_ALL, "Given DSD<%x> already has highest priority", eFlash2xSectVal); Status = STATUS_SUCCESS; break; @@ -3463,7 +3402,7 @@ int BcmSetActiveSection(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_secti HighestPriDSD = getHighestPriDSD(Adapter); - if ((HighestPriDSD == eFlash2xSectVal)) { + if (HighestPriDSD == eFlash2xSectVal) { BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, NVM_RW, DBG_LVL_ALL, "Made the DSD: %x highest by reducing priority of other\n", eFlash2xSectVal); Status = STATUS_SUCCESS; break; @@ -3482,7 +3421,7 @@ int BcmSetActiveSection(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_secti } HighestPriDSD = getHighestPriDSD(Adapter); - if ((HighestPriDSD == eFlash2xSectVal)) { + if (HighestPriDSD == eFlash2xSectVal) { Status = STATUS_SUCCESS; break; } @@ -3911,7 +3850,7 @@ int validateFlash2xReadWrite(struct bcm_mini_adapter *Adapter, struct bcm_flash2 uiNumOfBytes = psFlash2xReadWrite->numOfBytes; if (IsSectionExistInFlash(Adapter, psFlash2xReadWrite->Section) != TRUE) { - BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section<%x> does not exixt in Flash", psFlash2xReadWrite->Section); + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section<%x> does not exist in Flash", psFlash2xReadWrite->Section); return false; } uiSectStartOffset = BcmGetSectionValStartOffset(Adapter, psFlash2xReadWrite->Section); @@ -3944,6 +3883,15 @@ int validateFlash2xReadWrite(struct bcm_mini_adapter *Adapter, struct bcm_flash2 BCM_DEBUG_PRINT(Adapter, DBG_TYPE_OTHERS, NVM_RW, DBG_LVL_ALL, "End offset :%x\n", uiSectEndOffset); + /* psFlash2xReadWrite->offset and uiNumOfBytes are user controlled and can lead to integer overflows */ + if (psFlash2xReadWrite->offset > uiSectEndOffset) { + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Invalid Request...."); + return false; + } + if (uiNumOfBytes > uiSectEndOffset) { + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Invalid Request...."); + return false; + } /* Checking the boundary condition */ if ((uiSectStartOffset + psFlash2xReadWrite->offset + uiNumOfBytes) <= uiSectEndOffset) return TRUE; @@ -4126,7 +4074,7 @@ int BcmCopySection(struct bcm_mini_adapter *Adapter, * Faillure :- Return negative error code */ -int SaveHeaderIfPresent(struct bcm_mini_adapter *Adapter, PUCHAR pBuff, unsigned int uiOffset) +static int SaveHeaderIfPresent(struct bcm_mini_adapter *Adapter, PUCHAR pBuff, unsigned int uiOffset) { unsigned int offsetToProtect = 0, HeaderSizeToProtect = 0; bool bHasHeader = false; @@ -4265,7 +4213,7 @@ static int BcmDoChipSelect(struct bcm_mini_adapter *Adapter, unsigned int offset return STATUS_SUCCESS; } -int ReadDSDSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val dsd) +static int ReadDSDSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val dsd) { unsigned int uiDSDsig = 0; /* unsigned int sigoffsetInMap = 0; @@ -4290,7 +4238,7 @@ int ReadDSDSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_ return uiDSDsig; } -int ReadDSDPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val dsd) +static int ReadDSDPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val dsd) { /* unsigned int priOffsetInMap = 0 ; */ unsigned int uiDSDPri = STATUS_FAILURE; @@ -4313,7 +4261,7 @@ int ReadDSDPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_v return uiDSDPri; } -enum bcm_flash2x_section_val getHighestPriDSD(struct bcm_mini_adapter *Adapter) +static enum bcm_flash2x_section_val getHighestPriDSD(struct bcm_mini_adapter *Adapter) { int DSDHighestPri = STATUS_FAILURE; int DsdPri = 0; @@ -4345,7 +4293,7 @@ enum bcm_flash2x_section_val getHighestPriDSD(struct bcm_mini_adapter *Adapter) return HighestPriDSD; } -int ReadISOSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val iso) +static int ReadISOSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val iso) { unsigned int uiISOsig = 0; /* unsigned int sigoffsetInMap = 0; @@ -4368,7 +4316,7 @@ int ReadISOSignature(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_ return uiISOsig; } -int ReadISOPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val iso) +static int ReadISOPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val iso) { unsigned int ISOPri = STATUS_FAILURE; if (IsSectionWritable(Adapter, iso)) { @@ -4387,7 +4335,7 @@ int ReadISOPriority(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_v return ISOPri; } -enum bcm_flash2x_section_val getHighestPriISO(struct bcm_mini_adapter *Adapter) +static enum bcm_flash2x_section_val getHighestPriISO(struct bcm_mini_adapter *Adapter) { int ISOHighestPri = STATUS_FAILURE; int ISOPri = 0; @@ -4411,7 +4359,7 @@ enum bcm_flash2x_section_val getHighestPriISO(struct bcm_mini_adapter *Adapter) return HighestPriISO; } -int WriteToFlashWithoutSectorErase(struct bcm_mini_adapter *Adapter, +static int WriteToFlashWithoutSectorErase(struct bcm_mini_adapter *Adapter, PUINT pBuff, enum bcm_flash2x_section_val eFlash2xSectionVal, unsigned int uiOffset, @@ -4524,19 +4472,19 @@ bool IsSectionExistInFlash(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_se return SectionPresent; } -int IsSectionWritable(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val Section) +static int IsSectionWritable(struct bcm_mini_adapter *Adapter, enum bcm_flash2x_section_val Section) { int offset = STATUS_FAILURE; int Status = false; if (IsSectionExistInFlash(Adapter, Section) == false) { - BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section <%d> does not exixt", Section); + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section <%d> does not exist", Section); return false; } offset = BcmGetSectionValStartOffset(Adapter, Section); if (offset == INVALID_OFFSET) { - BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section<%d> does not exixt", Section); + BCM_DEBUG_PRINT(Adapter, DBG_TYPE_PRINTK, 0, 0, "Section<%d> does not exist", Section); return false; } |