From patchwork Wed Feb 7 13:51:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kalle Valo X-Patchwork-Id: 10205217 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5423A60247 for ; Wed, 7 Feb 2018 13:52:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4475D26246 for ; Wed, 7 Feb 2018 13:52:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3916D28F7E; Wed, 7 Feb 2018 13:52:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id A557726246 for ; Wed, 7 Feb 2018 13:51:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=4aUQiTeioX859ICUx4aA/AgqHoXPqCxchBuBDIGpOwc=; b=tZ2 hg3Ji212nr8alZZCW2KEEJCZCRPgr0/AJYavqjSqBxRoI8I5j/qtO9SVQ/w25tRYe5Xs/9TrVcxVa YrWHgTAkLpdwsJgu++M+l1pvHwb//z3x26MXsUou+e0laYGOr58dtHAELrTZ0GDUxpv+B0Lmq0G1l RerF+3R9MPLNIz1bEOTRTXqjSoX434YFL8LJqVdkpxCy7xzlLbu6F83luyDvTLCNIuUAUH/DnIVAj TCWnLtFuxISPSVKQ953rr+uC4quQdWRNLp/s6jS2HAntnlOUNCdXkhr1cfP2i4SNUINTGUrWWduwV spru+N7Pok7ObPxMEuHabQ2T+gPoV7A==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1ejQ8W-0006K1-QO; Wed, 07 Feb 2018 13:51:44 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1ejQ8T-0006Ip-Gs for ath10k@lists.infradead.org; Wed, 07 Feb 2018 13:51:43 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 8127D6079C; Wed, 7 Feb 2018 13:51:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1518011488; bh=8nBSsVkhfSPDgQIKk1Zan4B8FvDhGfhiVYklNuMlKUE=; h=From:To:Cc:Subject:Date:From; b=Ev4FbJIN5kZLNAkBFqtBo4Qvw2t6ZFKIgNVodztiIMFJV+4Hyk8Af9rgKDdaFY3H7 HVqwPDzoj22cbaKu+osygu6i645S1YyHMw4BfPf8V1+HPFFp0wCG+lFGFrJrYnMxYK RbuxYbileSf072bQ63qvbS0/CMDY59S4CEUqb78s= Received: from potku.adurom.net (88-114-240-52.elisa-laajakaista.fi [88.114.240.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: kvalo@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 34FC7601C4; Wed, 7 Feb 2018 13:51:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1518011488; bh=8nBSsVkhfSPDgQIKk1Zan4B8FvDhGfhiVYklNuMlKUE=; h=From:To:Cc:Subject:Date:From; b=Ev4FbJIN5kZLNAkBFqtBo4Qvw2t6ZFKIgNVodztiIMFJV+4Hyk8Af9rgKDdaFY3H7 HVqwPDzoj22cbaKu+osygu6i645S1YyHMw4BfPf8V1+HPFFp0wCG+lFGFrJrYnMxYK RbuxYbileSf072bQ63qvbS0/CMDY59S4CEUqb78s= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 34FC7601C4 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=kvalo@codeaurora.org From: Kalle Valo To: ath10k@lists.infradead.org Subject: [PATCH] Revert "ath10k: add sanity check to ie_len before parsing fw/board ie" Date: Wed, 7 Feb 2018 15:51:23 +0200 Message-Id: <1518011483-7704-1-git-send-email-kvalo@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-BeenThere: ath10k@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-wireless@vger.kernel.org, Ryan Hsu MIME-Version: 1.0 Sender: "ath10k" Errors-To: ath10k-bounces+patchwork-ath10k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Ryan Hsu This reverts commit 9ed4f91628737c820af6a1815b65bc06bd31518f. The commit introduced a regression that over read the ie with the padding. - the expected IE information ath10k_pci 0000:03:00.0: found firmware features ie (1 B) ath10k_pci 0000:03:00.0: Enabling feature bit: 6 ath10k_pci 0000:03:00.0: Enabling feature bit: 7 ath10k_pci 0000:03:00.0: features ath10k_pci 0000:03:00.0: 00000000: c0 00 00 00 00 00 00 00 - the wrong IE with padding is read (0x77) ath10k_pci 0000:03:00.0: found firmware features ie (4 B) ath10k_pci 0000:03:00.0: Enabling feature bit: 6 ath10k_pci 0000:03:00.0: Enabling feature bit: 7 ath10k_pci 0000:03:00.0: Enabling feature bit: 8 ath10k_pci 0000:03:00.0: Enabling feature bit: 9 ath10k_pci 0000:03:00.0: Enabling feature bit: 10 ath10k_pci 0000:03:00.0: Enabling feature bit: 12 ath10k_pci 0000:03:00.0: Enabling feature bit: 13 ath10k_pci 0000:03:00.0: Enabling feature bit: 14 ath10k_pci 0000:03:00.0: Enabling feature bit: 16 ath10k_pci 0000:03:00.0: Enabling feature bit: 17 ath10k_pci 0000:03:00.0: Enabling feature bit: 18 ath10k_pci 0000:03:00.0: features ath10k_pci 0000:03:00.0: 00000000: c0 77 07 00 00 00 00 00 Signed-off-by: Ryan Hsu Signed-off-by: Kalle Valo Tested-by: Mike Lothian --- drivers/net/wireless/ath/ath10k/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c index b0fdc1023619..fe9341c97f31 100644 --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c @@ -1276,10 +1276,7 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, len -= sizeof(*hdr); data = hdr->data; - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); - - if (len < ie_len) { + if (len < ALIGN(ie_len, 4)) { ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", ie_id, ie_len, len); ret = -EINVAL; @@ -1318,6 +1315,9 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, goto out; } + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); + len -= ie_len; data += ie_len; } @@ -1448,9 +1448,6 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, len -= sizeof(*hdr); data += sizeof(*hdr); - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); - if (len < ie_len) { ath10k_err(ar, "invalid length for FW IE %d (%zu < %zu)\n", ie_id, len, ie_len); @@ -1556,6 +1553,9 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, break; } + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); + len -= ie_len; data += ie_len; }