MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-13 12:49:35 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

wifi: brcmfmac: pcie: handle randbuf allocation failure

Browse Source 
[ Upstream commit 316f790ebc ]

The kzalloc() in brcmf_pcie_download_fw_nvram() will return null
if the physical memory has run out. As a result, if we use
get_random_bytes() to generate random bytes in the randbuf, the
null pointer dereference bug will happen.

In order to prevent allocation failure, this patch adds a separate
function using buffer on kernel stack to generate random bytes in
the randbuf, which could prevent the kernel stack from overflow.

Fixes: 91918ce88d ("wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240306140437.18177-1-duoming@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Duoming Zhou 2024-03-06 22:04:37 +08:00 committed by Greg Kroah-Hartman
parent 014e4e9275
commit c37466406f
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
View File

@ -1675,6 +1675,15 @@ struct brcmf_random_seed_footer {
#define BRCMF_RANDOM_SEED_MAGIC 0xfeedc0de #define BRCMF_RANDOM_SEED_MAGIC 0xfeedc0de
#define BRCMF_RANDOM_SEED_LENGTH 0x100 #define BRCMF_RANDOM_SEED_LENGTH 0x100
static noinline_for_stack void
brcmf_pcie_provide_random_bytes(struct brcmf_pciedev_info *devinfo, u32 address)
{
u8 randbuf[BRCMF_RANDOM_SEED_LENGTH];
get_random_bytes(randbuf, BRCMF_RANDOM_SEED_LENGTH);
memcpy_toio(devinfo->tcm + address, randbuf, BRCMF_RANDOM_SEED_LENGTH);
}
static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
const struct firmware *fw, void *nvram, const struct firmware *fw, void *nvram,
u32 nvram_len) u32 nvram_len)
@ -1717,7 +1726,6 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
.length = cpu_to_le32(rand_len), .length = cpu_to_le32(rand_len),
.magic = cpu_to_le32(BRCMF_RANDOM_SEED_MAGIC), .magic = cpu_to_le32(BRCMF_RANDOM_SEED_MAGIC),
}; };
void *randbuf;
/* Some Apple chips/firmwares expect a buffer of random /* Some Apple chips/firmwares expect a buffer of random
* data to be present before NVRAM * data to be present before NVRAM
@ -1729,10 +1737,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo,
sizeof(footer)); sizeof(footer));
address -= rand_len; address -= rand_len;
randbuf = kzalloc(rand_len, GFP_KERNEL); brcmf_pcie_provide_random_bytes(devinfo, address);
get_random_bytes(randbuf, rand_len);
memcpy_toio(devinfo->tcm + address, randbuf, rand_len);
kfree(randbuf);
} }
} else { } else {
brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", brcmf_dbg(PCIE, "No matching NVRAM file found %s\n",