* [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer @ 2012-02-08 21:08 Tim Gardner 2012-02-08 21:45 ` Ben Hutchings 0 siblings, 1 reply; 8+ messages in thread From: Tim Gardner @ 2012-02-08 21:08 UTC (permalink / raw) To: Larry.Finger Cc: Tim Gardner, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel The firmware file size check does not use the correct limit. Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: Chaoming Li <chaoming_li@realsil.com.cn> Cc: John W. Linville <linville@tuxdriver.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tim Gardner <tim.gardner@canonical.com> --- drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h index babe85d..5c377fc 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h @@ -30,6 +30,7 @@ #define __REALTEK_FIRMWARE92S_H__ #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 #define RTL8190_CPU_START_OFFSET 0x80 /* Firmware Local buffer size. 64k */ #define MAX_FIRMWARE_CODE_SIZE 0xFF00 @@ -217,7 +218,7 @@ struct rt_firmware { u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; u32 fw_imem_len; u32 fw_emem_len; - u8 sz_fw_tmpbuffer[164000]; + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; u32 sz_fw_tmpbufferlen; u16 cmdpacket_fragthresold; }; diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c index ca38dd9..155da0a 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) rtlpriv->max_fw_size = 0; return; } - if (firmware->size > rtlpriv->max_fw_size) { + if (firmware->size >= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Firmware is too big!\n"); release_firmware(firmware); -- 1.7.9 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-08 21:08 [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer Tim Gardner @ 2012-02-08 21:45 ` Ben Hutchings 2012-02-09 0:55 ` Larry Finger 2012-02-09 2:30 ` Larry Finger 0 siblings, 2 replies; 8+ messages in thread From: Ben Hutchings @ 2012-02-08 21:45 UTC (permalink / raw) To: Tim Gardner Cc: Larry.Finger, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel On Wed, 2012-02-08 at 14:08 -0700, Tim Gardner wrote: > The firmware file size check does not use the > correct limit. > > Cc: Larry Finger <Larry.Finger@lwfinger.net> > Cc: Chaoming Li <chaoming_li@realsil.com.cn> > Cc: John W. Linville <linville@tuxdriver.com> > Cc: linux-wireless@vger.kernel.org > Cc: netdev@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Signed-off-by: Tim Gardner <tim.gardner@canonical.com> > --- > drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- > drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- > 2 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > index babe85d..5c377fc 100644 > --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h > @@ -30,6 +30,7 @@ > #define __REALTEK_FIRMWARE92S_H__ > > #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 > +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 > #define RTL8190_CPU_START_OFFSET 0x80 > /* Firmware Local buffer size. 64k */ > #define MAX_FIRMWARE_CODE_SIZE 0xFF00 > @@ -217,7 +218,7 @@ struct rt_firmware { > u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; > u32 fw_imem_len; > u32 fw_emem_len; > - u8 sz_fw_tmpbuffer[164000]; > + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; > u32 sz_fw_tmpbufferlen; > u16 cmdpacket_fragthresold; > }; > diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > index ca38dd9..155da0a 100644 > --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c > @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) > rtlpriv->max_fw_size = 0; > return; > } > - if (firmware->size > rtlpriv->max_fw_size) { > + if (firmware->size >= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { This appears to reject a firmware blob which is exactly the maximum size, which looks wrong. Also doesn't this make the max_fw_size field redundant? Ben. > RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, > "Firmware is too big!\n"); > release_firmware(firmware); -- Ben Hutchings, Staff Engineer, Solarflare Not speaking for my employer; that's the marketing department's job. They asked us to note that Solarflare product names are trademarked. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-08 21:45 ` Ben Hutchings @ 2012-02-09 0:55 ` Larry Finger 2012-02-09 2:30 ` Larry Finger 1 sibling, 0 replies; 8+ messages in thread From: Larry Finger @ 2012-02-09 0:55 UTC (permalink / raw) To: Ben Hutchings Cc: Tim Gardner, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel On 02/08/2012 03:45 PM, Ben Hutchings wrote: > On Wed, 2012-02-08 at 14:08 -0700, Tim Gardner wrote: >> The firmware file size check does not use the >> correct limit. >> >> Cc: Larry Finger<Larry.Finger@lwfinger.net> >> Cc: Chaoming Li<chaoming_li@realsil.com.cn> >> Cc: John W. Linville<linville@tuxdriver.com> >> Cc: linux-wireless@vger.kernel.org >> Cc: netdev@vger.kernel.org >> Cc: linux-kernel@vger.kernel.org >> Signed-off-by: Tim Gardner<tim.gardner@canonical.com> >> --- >> drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- >> drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- >> 2 files changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> index babe85d..5c377fc 100644 >> --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> @@ -30,6 +30,7 @@ >> #define __REALTEK_FIRMWARE92S_H__ >> >> #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 >> +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 >> #define RTL8190_CPU_START_OFFSET 0x80 >> /* Firmware Local buffer size. 64k */ >> #define MAX_FIRMWARE_CODE_SIZE 0xFF00 >> @@ -217,7 +218,7 @@ struct rt_firmware { >> u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; >> u32 fw_imem_len; >> u32 fw_emem_len; >> - u8 sz_fw_tmpbuffer[164000]; >> + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; >> u32 sz_fw_tmpbufferlen; >> u16 cmdpacket_fragthresold; >> }; >> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> index ca38dd9..155da0a 100644 >> --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) >> rtlpriv->max_fw_size = 0; >> return; >> } >> - if (firmware->size> rtlpriv->max_fw_size) { >> + if (firmware->size>= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { > > This appears to reject a firmware blob which is exactly the maximum > size, which looks wrong. Also doesn't this make the max_fw_size field > redundant? > > Ben. > >> RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, >> "Firmware is too big!\n"); >> release_firmware(firmware); > For all the drivers under rtlwifi, max_fw_size is set to zero whenever the required firmware file is not found. In the original version with synchronous firmware loading, the existence of the required file and it's size were known immediately, but with the asynch loading now used, that info is not known until later. Thus a parameter is used. In addition, rtl8192ce, rtl8192cu, and rtl8192de all share the same asynchronous loading callback routine, but each has a different firmware size. The parameter max_fw_size contains that info as well. The patch is NACKed. Larry ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-08 21:45 ` Ben Hutchings 2012-02-09 0:55 ` Larry Finger @ 2012-02-09 2:30 ` Larry Finger 2012-02-09 14:41 ` Tim Gardner 1 sibling, 1 reply; 8+ messages in thread From: Larry Finger @ 2012-02-09 2:30 UTC (permalink / raw) To: Tim Gardner Cc: Ben Hutchings, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel On 02/08/2012 03:45 PM, Ben Hutchings wrote: > On Wed, 2012-02-08 at 14:08 -0700, Tim Gardner wrote: >> The firmware file size check does not use the >> correct limit. >> >> Cc: Larry Finger<Larry.Finger@lwfinger.net> >> Cc: Chaoming Li<chaoming_li@realsil.com.cn> >> Cc: John W. Linville<linville@tuxdriver.com> >> Cc: linux-wireless@vger.kernel.org >> Cc: netdev@vger.kernel.org >> Cc: linux-kernel@vger.kernel.org >> Signed-off-by: Tim Gardner<tim.gardner@canonical.com> >> --- >> drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- >> drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- >> 2 files changed, 3 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> index babe85d..5c377fc 100644 >> --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >> @@ -30,6 +30,7 @@ >> #define __REALTEK_FIRMWARE92S_H__ >> >> #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 >> +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 The current size of the firmware is 88,856, thus the value of RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE should be set to 90,000 to allow for some growth in the size of the firmware. Using 164,000 wastes a lot of space. >> #define RTL8190_CPU_START_OFFSET 0x80 >> /* Firmware Local buffer size. 64k */ >> #define MAX_FIRMWARE_CODE_SIZE 0xFF00 >> @@ -217,7 +218,7 @@ struct rt_firmware { >> u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; >> u32 fw_imem_len; >> u32 fw_emem_len; >> - u8 sz_fw_tmpbuffer[164000]; >> + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; >> u32 sz_fw_tmpbufferlen; >> u16 cmdpacket_fragthresold; >> }; >> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> index ca38dd9..155da0a 100644 >> --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >> @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) >> rtlpriv->max_fw_size = 0; >> return; >> } >> - if (firmware->size> rtlpriv->max_fw_size) { >> + if (firmware->size>= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { Do not change this one. rtlpriv->max_fw_size has been set to sizeof(struct rt_firmware), which is correct. > > This appears to reject a firmware blob which is exactly the maximum > size, which looks wrong. Also doesn't this make the max_fw_size field > redundant? I commented on this one earlier, but to reiterate - max_fw_size is not redundant. Larry ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-09 2:30 ` Larry Finger @ 2012-02-09 14:41 ` Tim Gardner 2012-02-09 16:43 ` Larry Finger 0 siblings, 1 reply; 8+ messages in thread From: Tim Gardner @ 2012-02-09 14:41 UTC (permalink / raw) To: Larry Finger Cc: Ben Hutchings, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel [-- Attachment #1: Type: text/plain, Size: 3389 bytes --] On 02/08/2012 07:30 PM, Larry Finger wrote: > On 02/08/2012 03:45 PM, Ben Hutchings wrote: >> On Wed, 2012-02-08 at 14:08 -0700, Tim Gardner wrote: >>> The firmware file size check does not use the >>> correct limit. >>> >>> Cc: Larry Finger<Larry.Finger@lwfinger.net> >>> Cc: Chaoming Li<chaoming_li@realsil.com.cn> >>> Cc: John W. Linville<linville@tuxdriver.com> >>> Cc: linux-wireless@vger.kernel.org >>> Cc: netdev@vger.kernel.org >>> Cc: linux-kernel@vger.kernel.org >>> Signed-off-by: Tim Gardner<tim.gardner@canonical.com> >>> --- >>> drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- >>> drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 2 +- >>> 2 files changed, 3 insertions(+), 2 deletions(-) >>> >>> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >>> b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >>> index babe85d..5c377fc 100644 >>> --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >>> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h >>> @@ -30,6 +30,7 @@ >>> #define __REALTEK_FIRMWARE92S_H__ >>> >>> #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 >>> +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 > > The current size of the firmware is 88,856, thus the value of > RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE should be set to 90,000 to allow for > some growth in the size of the firmware. Using 164,000 wastes a lot of > space. > >>> #define RTL8190_CPU_START_OFFSET 0x80 >>> /* Firmware Local buffer size. 64k */ >>> #define MAX_FIRMWARE_CODE_SIZE 0xFF00 >>> @@ -217,7 +218,7 @@ struct rt_firmware { >>> u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; >>> u32 fw_imem_len; >>> u32 fw_emem_len; >>> - u8 sz_fw_tmpbuffer[164000]; >>> + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; >>> u32 sz_fw_tmpbufferlen; >>> u16 cmdpacket_fragthresold; >>> }; >>> diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >>> b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >>> index ca38dd9..155da0a 100644 >>> --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >>> +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c >>> @@ -105,7 +105,7 @@ static void rtl92se_fw_cb(const struct firmware >>> *firmware, void *context) >>> rtlpriv->max_fw_size = 0; >>> return; >>> } >>> - if (firmware->size> rtlpriv->max_fw_size) { >>> + if (firmware->size>= RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE) { > > Do not change this one. rtlpriv->max_fw_size has been set to > sizeof(struct rt_firmware), which is correct. > >> >> This appears to reject a firmware blob which is exactly the maximum >> size, which looks wrong. Also doesn't this make the max_fw_size field >> redundant? > > I commented on this one earlier, but to reiterate - max_fw_size is not > redundant. > > Larry I agree with you about the semantics of rtlpriv->max_fw_size, but I don't agree that the size check is correct. While rtlpriv->max_fw_size has been set to sizeof(struct rt_firmware), that value is _way_ bigger then the size of the target buffer. sizeof(struct rt_firmware) == 64000+64000+164000 plus some change The target buffer size is only 164000 bytes. I've attached v2 of the patch that is simpler and may serve to better illustrate my point. By the way, Ben Hutchings was right about the original patch having an off by one error. This version also clears rtlpriv->max_fw_size if the size check fails. Probably should have mentioned that in the commit log. rtg -- Tim Gardner tim.gardner@canonical.com [-- Attachment #2: 0001-rtlwifi-rtl8192se-firmware-load-can-overflow-target-.patch --] [-- Type: text/x-patch, Size: 2380 bytes --] >From 1312472fb7b9526c3a3197572c7ba482d6c196a0 Mon Sep 17 00:00:00 2001 From: Tim Gardner <tim.gardner@canonical.com> Date: Wed, 8 Feb 2012 13:11:47 -0700 Subject: [PATCH v2] rtlwifi: rtl8192se firmware load can overflow target buffer The firmware file size check does not use the correct limit. Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: Chaoming Li <chaoming_li@realsil.com.cn> Cc: John W. Linville <linville@tuxdriver.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tim Gardner <tim.gardner@canonical.com> --- drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h index babe85d..5c377fc 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h @@ -30,6 +30,7 @@ #define __REALTEK_FIRMWARE92S_H__ #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 164000 #define RTL8190_CPU_START_OFFSET 0x80 /* Firmware Local buffer size. 64k */ #define MAX_FIRMWARE_CODE_SIZE 0xFF00 @@ -217,7 +218,7 @@ struct rt_firmware { u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; u32 fw_imem_len; u32 fw_emem_len; - u8 sz_fw_tmpbuffer[164000]; + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; u32 sz_fw_tmpbufferlen; u16 cmdpacket_fragthresold; }; diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c index ca38dd9..345d752 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c @@ -108,6 +108,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) if (firmware->size > rtlpriv->max_fw_size) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Firmware is too big!\n"); + rtlpriv->max_fw_size = 0; release_firmware(firmware); return; } @@ -232,7 +233,7 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) return 1; } - rtlpriv->max_fw_size = sizeof(struct rt_firmware); + rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE; pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n" "Loading firmware %s\n", rtlpriv->cfg->fw_name); -- 1.7.9 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-09 14:41 ` Tim Gardner @ 2012-02-09 16:43 ` Larry Finger 2012-02-09 17:25 ` [PATCH v3] " Tim Gardner 0 siblings, 1 reply; 8+ messages in thread From: Larry Finger @ 2012-02-09 16:43 UTC (permalink / raw) To: tim.gardner Cc: Tim Gardner, Ben Hutchings, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel On 02/09/2012 08:41 AM, Tim Gardner wrote: > > I agree with you about the semantics of rtlpriv->max_fw_size, but I don't agree > that the size check is correct. While rtlpriv->max_fw_size has been set to > sizeof(struct rt_firmware), that value is _way_ bigger then the size of the > target buffer. > > sizeof(struct rt_firmware) == 64000+64000+164000 plus some change > > The target buffer size is only 164000 bytes. > > I've attached v2 of the patch that is simpler and may serve to better illustrate > my point. By the way, Ben Hutchings was right about the original patch having an > off by one error. This version also clears rtlpriv->max_fw_size if the size > check fails. Probably should have mentioned that in the commit log. I agree that Ben is right. This thread forced me to go back to square one in analyzing the situation. For the other drivers in the rtlwifi family, the firmware file contains an image that is directly stuffed into the device. For the RTL8192SE devices, it is more complicated. The structure is described in struct rt_firmware. At the moment, the arrays there are grossly oversized. They could be as follows: struct rt_firmware { struct fw_hdr *pfwheader; enum fw_status fwstatus; u16 firmwareversion; u8 fw_imem[RTL8190_MAX_IMEM_CODE_SIZE]; u8 fw_emem[RTL8190_MAX_DMEM_CODE_SIZE]; u32 fw_imem_len; u32 fw_emem_len; u8 sz_fw_tmpbuffer[RTL8190_MAX_FIRMWARE_SIZE]; u32 sz_fw_tmpbufferlen; u16 cmdpacket_fragthresold; }; with RTL8190_MAX_IMEM_CODE_SIZE = 54000 (current fw is 51,208), RTL8190_MAX_DMEM_CODE_SIZE = 40000 (current fw is 37,520), and RTL8190_MAX_FIRMWARE_SIZE = 90000 (it holds the raw firmware image, which is currently 88,856). Ultimately, all three arrays should be eliminated. Now that we are using asynchronous loading, the kernel should keep its cached data and not copy it into the driver's private storage when a pointer will suffice. All the drivers need this change, but that can wait for now. I will ACK the patch if you resumit it with #define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 90000 Larry ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v3] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-09 16:43 ` Larry Finger @ 2012-02-09 17:25 ` Tim Gardner 2012-02-10 0:21 ` Larry Finger 0 siblings, 1 reply; 8+ messages in thread From: Tim Gardner @ 2012-02-09 17:25 UTC (permalink / raw) To: Larry Finger Cc: Tim Gardner, Ben Hutchings, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel [-- Attachment #1: Type: text/plain, Size: 2408 bytes --] On 02/09/2012 09:43 AM, Larry Finger wrote: > On 02/09/2012 08:41 AM, Tim Gardner wrote: >> >> I agree with you about the semantics of rtlpriv->max_fw_size, but I >> don't agree >> that the size check is correct. While rtlpriv->max_fw_size has been >> set to >> sizeof(struct rt_firmware), that value is _way_ bigger then the size >> of the >> target buffer. >> >> sizeof(struct rt_firmware) == 64000+64000+164000 plus some change >> >> The target buffer size is only 164000 bytes. >> >> I've attached v2 of the patch that is simpler and may serve to better >> illustrate >> my point. By the way, Ben Hutchings was right about the original patch >> having an >> off by one error. This version also clears rtlpriv->max_fw_size if the >> size >> check fails. Probably should have mentioned that in the commit log. > > I agree that Ben is right. > > This thread forced me to go back to square one in analyzing the > situation. For the other drivers in the rtlwifi family, the firmware > file contains an image that is directly stuffed into the device. For the > RTL8192SE devices, it is more complicated. The structure is described in > struct rt_firmware. At the moment, the arrays there are grossly > oversized. They could be as follows: > > struct rt_firmware { > struct fw_hdr *pfwheader; > enum fw_status fwstatus; > u16 firmwareversion; > u8 fw_imem[RTL8190_MAX_IMEM_CODE_SIZE]; > u8 fw_emem[RTL8190_MAX_DMEM_CODE_SIZE]; > u32 fw_imem_len; > u32 fw_emem_len; > u8 sz_fw_tmpbuffer[RTL8190_MAX_FIRMWARE_SIZE]; > u32 sz_fw_tmpbufferlen; > u16 cmdpacket_fragthresold; > }; > > with > > RTL8190_MAX_IMEM_CODE_SIZE = 54000 (current fw is 51,208), > RTL8190_MAX_DMEM_CODE_SIZE = 40000 (current fw is 37,520), and > RTL8190_MAX_FIRMWARE_SIZE = 90000 (it holds the raw firmware image, > which is currently 88,856). > > Ultimately, all three arrays should be eliminated. Now that we are using > asynchronous loading, the kernel should keep its cached data and not > copy it into the driver's private storage when a pointer will suffice. > All the drivers need this change, but that can wait for now. > > I will ACK the patch if you resumit it with > #define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 90000 > > Larry v3 expands the commit log a bit. It doesn't apply to stable 3.2.y, but could easily be backported. If I remember I'll do it when its merged in Linus' tree. rtg -- Tim Gardner tim.gardner@canonical.com [-- Attachment #2: 0001-rtlwifi-rtl8192se-firmware-load-can-overflow-target-.patch --] [-- Type: text/x-patch, Size: 2847 bytes --] >From 1c26d8e099c2720aebf106daeb7814114051a596 Mon Sep 17 00:00:00 2001 From: Tim Gardner <tim.gardner@canonical.com> Date: Wed, 8 Feb 2012 13:11:47 -0700 Subject: [PATCH v3] rtlwifi: rtl8192se firmware load can overflow target buffer Define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE which represents the maximimum possible firmware file size. Use it in the definition of the buffer which receives the firmware file data. Set RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE closer to the actual size of the firmware file, e.g., 90000 (down from hard coded 164000). The current size of rtlwifi/rtl8192sefw.bin is 88856. Set max_fw_size to RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE for the size limit check. Fix the error case where max_fw_size is not cleared if the size limit check fails. Cc: Larry Finger <Larry.Finger@lwfinger.net> Cc: Chaoming Li <chaoming_li@realsil.com.cn> Cc: John W. Linville <linville@tuxdriver.com> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Tim Gardner <tim.gardner@canonical.com> --- drivers/net/wireless/rtlwifi/rtl8192se/fw.h | 3 ++- drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h index babe85d..b4afff6 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.h +++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.h @@ -30,6 +30,7 @@ #define __REALTEK_FIRMWARE92S_H__ #define RTL8190_MAX_FIRMWARE_CODE_SIZE 64000 +#define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 90000 #define RTL8190_CPU_START_OFFSET 0x80 /* Firmware Local buffer size. 64k */ #define MAX_FIRMWARE_CODE_SIZE 0xFF00 @@ -217,7 +218,7 @@ struct rt_firmware { u8 fw_emem[RTL8190_MAX_FIRMWARE_CODE_SIZE]; u32 fw_imem_len; u32 fw_emem_len; - u8 sz_fw_tmpbuffer[164000]; + u8 sz_fw_tmpbuffer[RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE]; u32 sz_fw_tmpbufferlen; u16 cmdpacket_fragthresold; }; diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c index ca38dd9..345d752 100644 --- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c +++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c @@ -108,6 +108,7 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) if (firmware->size > rtlpriv->max_fw_size) { RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "Firmware is too big!\n"); + rtlpriv->max_fw_size = 0; release_firmware(firmware); return; } @@ -232,7 +233,7 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) return 1; } - rtlpriv->max_fw_size = sizeof(struct rt_firmware); + rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE; pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n" "Loading firmware %s\n", rtlpriv->cfg->fw_name); -- 1.7.9 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v3] rtlwifi: rtl8192se firmware load can overflow target buffer 2012-02-09 17:25 ` [PATCH v3] " Tim Gardner @ 2012-02-10 0:21 ` Larry Finger 0 siblings, 0 replies; 8+ messages in thread From: Larry Finger @ 2012-02-10 0:21 UTC (permalink / raw) To: tim.gardner Cc: Tim Gardner, Ben Hutchings, Chaoming Li, John W. Linville, linux-wireless, netdev, linux-kernel On 02/09/2012 11:25 AM, Tim Gardner wrote: > On 02/09/2012 09:43 AM, Larry Finger wrote: >> On 02/09/2012 08:41 AM, Tim Gardner wrote: >>> >>> I agree with you about the semantics of rtlpriv->max_fw_size, but I >>> don't agree >>> that the size check is correct. While rtlpriv->max_fw_size has been >>> set to >>> sizeof(struct rt_firmware), that value is _way_ bigger then the size >>> of the >>> target buffer. >>> >>> sizeof(struct rt_firmware) == 64000+64000+164000 plus some change >>> >>> The target buffer size is only 164000 bytes. >>> >>> I've attached v2 of the patch that is simpler and may serve to better >>> illustrate >>> my point. By the way, Ben Hutchings was right about the original patch >>> having an >>> off by one error. This version also clears rtlpriv->max_fw_size if the >>> size >>> check fails. Probably should have mentioned that in the commit log. >> >> I agree that Ben is right. >> >> This thread forced me to go back to square one in analyzing the >> situation. For the other drivers in the rtlwifi family, the firmware >> file contains an image that is directly stuffed into the device. For the >> RTL8192SE devices, it is more complicated. The structure is described in >> struct rt_firmware. At the moment, the arrays there are grossly >> oversized. They could be as follows: >> >> struct rt_firmware { >> struct fw_hdr *pfwheader; >> enum fw_status fwstatus; >> u16 firmwareversion; >> u8 fw_imem[RTL8190_MAX_IMEM_CODE_SIZE]; >> u8 fw_emem[RTL8190_MAX_DMEM_CODE_SIZE]; >> u32 fw_imem_len; >> u32 fw_emem_len; >> u8 sz_fw_tmpbuffer[RTL8190_MAX_FIRMWARE_SIZE]; >> u32 sz_fw_tmpbufferlen; >> u16 cmdpacket_fragthresold; >> }; >> >> with >> >> RTL8190_MAX_IMEM_CODE_SIZE = 54000 (current fw is 51,208), >> RTL8190_MAX_DMEM_CODE_SIZE = 40000 (current fw is 37,520), and >> RTL8190_MAX_FIRMWARE_SIZE = 90000 (it holds the raw firmware image, >> which is currently 88,856). >> >> Ultimately, all three arrays should be eliminated. Now that we are using >> asynchronous loading, the kernel should keep its cached data and not >> copy it into the driver's private storage when a pointer will suffice. >> All the drivers need this change, but that can wait for now. >> >> I will ACK the patch if you resumit it with >> #define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 90000 >> >> Larry > > v3 expands the commit log a bit. It doesn't apply to stable 3.2.y, but could > easily be backported. If I remember I'll do it when its merged in Linus' tree. I added my S-O-B and pushed it on to John. Thanks, Larry ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2012-02-10 0:21 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2012-02-08 21:08 [PATCH] rtlwifi: rtl8192se firmware load can overflow target buffer Tim Gardner 2012-02-08 21:45 ` Ben Hutchings 2012-02-09 0:55 ` Larry Finger 2012-02-09 2:30 ` Larry Finger 2012-02-09 14:41 ` Tim Gardner 2012-02-09 16:43 ` Larry Finger 2012-02-09 17:25 ` [PATCH v3] " Tim Gardner 2012-02-10 0:21 ` Larry Finger
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).