i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

idualwifi & iaxwifi: Merge changes from OpenBSD.

Browse Source
This commit is contained in:
Augustin Cavalier
2022-09-27 19:34:43 -04:00
parent d052479f68
commit 3f3b84894b
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c
+11 -2
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: if_iwx.c,v 1.149 2022/05/14 05:42:39 stsp Exp $ */
/* $OpenBSD: if_iwx.c,v 1.150 2022/08/29 17:59:12 stsp Exp $ */
/*
* Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -1577,6 +1577,13 @@ iwx_read_firmware(struct iwx_softc *sc)
goto parse_out;
}
/*
* Check for size_t overflow and ignore missing padding at
* end of firmware file.
*/
if (roundup(tlv_len, 4) > len)
break;
len -= roundup(tlv_len, 4);
data += roundup(tlv_len, 4);
}
@@ -4023,6 +4030,8 @@ iwx_pnvm_handle_section(struct iwx_softc *sc, const uint8_t *data,
break;
}
if (roundup(tlv_len, 4) > len)
break;
len -= roundup(tlv_len, 4);
data += roundup(tlv_len, 4);
}
@@ -4061,7 +4070,7 @@ iwx_pnvm_parse(struct iwx_softc *sc, const uint8_t *data, size_t len)
tlv_len = le32toh(tlv->length);
tlv_type = le32toh(tlv->type);
if (len < tlv_len)
if (len < tlv_len || roundup(tlv_len, 4) > len)
return EINVAL;
if (tlv_type == IWX_UCODE_TLV_PNVM_SKU) {
src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c
+9 -6
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: if_iwm.c,v 1.401 2022/06/04 11:32:11 stsp Exp $ */
/* $OpenBSD: if_iwm.c,v 1.404 2022/08/29 17:59:12 stsp Exp $ */
/*
* Copyright (c) 2014, 2016 genua gmbh <info@genua.de>
@@ -1025,6 +1025,13 @@ iwm_read_firmware(struct iwm_softc *sc)
goto parse_out;
}
/*
* Check for size_t overflow and ignore missing padding at
* end of firmware file.
*/
if (roundup(tlv_len, 4) > len)
break;
len -= roundup(tlv_len, 4);
data += roundup(tlv_len, 4);
}
@@ -4607,7 +4614,7 @@ iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx)
if (err) {
/* XXX */
if (fatal)
panic("iwm: could not load RX mbuf: %d", err);
panic("iwm: could not load RX mbuf");
m_freem(m);
return err;
}
@@ -5725,9 +5732,6 @@ iwm_txq_advance(struct iwm_softc *sc, struct iwm_tx_ring *ring, int idx)
while (ring->tail != idx) {
txd = &ring->data[ring->tail];
if (txd->m != NULL) {
if (ring->qid < IWM_FIRST_AGG_TX_QUEUE)
DPRINTF(("%s: missed Tx completion: tail=%d "
"idx=%d\n", __func__, ring->tail, idx));
iwm_reset_sched(sc, ring->qid, ring->tail, IWM_STATION_ID);
iwm_txd_done(sc, txd);
ring->queued--;
@@ -8797,7 +8801,6 @@ iwm_auth(struct iwm_softc *sc)
err = iwm_phy_ctxt_update(sc, &sc->sc_phyctxt[0],
in->in_ni.ni_chan, 1, 1, 0, IEEE80211_HTOP0_SCO_SCN,
IEEE80211_VHTOP0_CHAN_WIDTH_HT);
if (err)
if (err)
return err;
}