From 3f3b84894b9e3e5946c9a350e2d42e7297e284a6 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Tue, 27 Sep 2022 19:34:43 -0400 Subject: [PATCH] idualwifi & iaxwifi: Merge changes from OpenBSD. --- .../network/wlan/iaxwifi200/dev/pci/if_iwx.c | 13 +++++++++++-- .../network/wlan/idualwifi7260/dev/pci/if_iwm.c | 15 +++++++++------ 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c index 3794b77643..1ff01b3f1b 100644 --- a/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c +++ b/src/add-ons/kernel/drivers/network/wlan/iaxwifi200/dev/pci/if_iwx.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_iwx.c,v 1.149 2022/05/14 05:42:39 stsp Exp $ */ +/* $OpenBSD: if_iwx.c,v 1.150 2022/08/29 17:59:12 stsp Exp $ */ /* * Copyright (c) 2014, 2016 genua gmbh @@ -1577,6 +1577,13 @@ iwx_read_firmware(struct iwx_softc *sc) goto parse_out; } + /* + * Check for size_t overflow and ignore missing padding at + * end of firmware file. + */ + if (roundup(tlv_len, 4) > len) + break; + len -= roundup(tlv_len, 4); data += roundup(tlv_len, 4); } @@ -4023,6 +4030,8 @@ iwx_pnvm_handle_section(struct iwx_softc *sc, const uint8_t *data, break; } + if (roundup(tlv_len, 4) > len) + break; len -= roundup(tlv_len, 4); data += roundup(tlv_len, 4); } @@ -4061,7 +4070,7 @@ iwx_pnvm_parse(struct iwx_softc *sc, const uint8_t *data, size_t len) tlv_len = le32toh(tlv->length); tlv_type = le32toh(tlv->type); - if (len < tlv_len) + if (len < tlv_len || roundup(tlv_len, 4) > len) return EINVAL; if (tlv_type == IWX_UCODE_TLV_PNVM_SKU) { diff --git a/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c b/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c index 214d257058..c3564d8b8e 100644 --- a/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c +++ b/src/add-ons/kernel/drivers/network/wlan/idualwifi7260/dev/pci/if_iwm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_iwm.c,v 1.401 2022/06/04 11:32:11 stsp Exp $ */ +/* $OpenBSD: if_iwm.c,v 1.404 2022/08/29 17:59:12 stsp Exp $ */ /* * Copyright (c) 2014, 2016 genua gmbh @@ -1025,6 +1025,13 @@ iwm_read_firmware(struct iwm_softc *sc) goto parse_out; } + /* + * Check for size_t overflow and ignore missing padding at + * end of firmware file. + */ + if (roundup(tlv_len, 4) > len) + break; + len -= roundup(tlv_len, 4); data += roundup(tlv_len, 4); } @@ -4607,7 +4614,7 @@ iwm_rx_addbuf(struct iwm_softc *sc, int size, int idx) if (err) { /* XXX */ if (fatal) - panic("iwm: could not load RX mbuf: %d", err); + panic("iwm: could not load RX mbuf"); m_freem(m); return err; } @@ -5725,9 +5732,6 @@ iwm_txq_advance(struct iwm_softc *sc, struct iwm_tx_ring *ring, int idx) while (ring->tail != idx) { txd = &ring->data[ring->tail]; if (txd->m != NULL) { - if (ring->qid < IWM_FIRST_AGG_TX_QUEUE) - DPRINTF(("%s: missed Tx completion: tail=%d " - "idx=%d\n", __func__, ring->tail, idx)); iwm_reset_sched(sc, ring->qid, ring->tail, IWM_STATION_ID); iwm_txd_done(sc, txd); ring->queued--; @@ -8797,7 +8801,6 @@ iwm_auth(struct iwm_softc *sc) err = iwm_phy_ctxt_update(sc, &sc->sc_phyctxt[0], in->in_ni.ni_chan, 1, 1, 0, IEEE80211_HTOP0_SCO_SCN, IEEE80211_VHTOP0_CHAN_WIDTH_HT); - if (err) if (err) return err; }