Index: sys/dev/usb/wlan/if_upgt.c =================================================================== --- sys/dev/usb/wlan/if_upgt.c +++ sys/dev/usb/wlan/if_upgt.c @@ -118,7 +118,7 @@ static struct mbuf * upgt_rxeof(struct usb_xfer *, struct upgt_data *, int *); static struct mbuf * - upgt_rx(struct upgt_softc *, uint8_t *, int, int *); + upgt_rx(struct upgt_softc *, uint8_t *, uint16_t, int *); static void upgt_txeof(struct usb_xfer *, struct upgt_data *); static int upgt_eeprom_read(struct upgt_softc *); static int upgt_eeprom_parse(struct upgt_softc *); @@ -306,7 +306,9 @@ DPRINTF(sc, UPGT_DEBUG_FW, "memory address rx start=0x%08x\n", sc->sc_memaddr_rx_start); - upgt_mem_init(sc); + error = upgt_mem_init(sc); + if (error) + goto fail4; /* Load the firmware. */ error = upgt_fw_load(sc); @@ -1043,7 +1045,7 @@ struct ieee80211com *ic = &sc->sc_ic; struct upgt_eeprom_header *eeprom_header; struct upgt_eeprom_option *eeprom_option; - uint16_t option_len; + uint32_t option_len; uint16_t option_type; uint16_t preamble_len; int option_end = 0; @@ -1058,7 +1060,9 @@ /* sanity check */ if (eeprom_option >= (struct upgt_eeprom_option *) - (sc->sc_eeprom + UPGT_EEPROM_SIZE)) { + (sc->sc_eeprom + UPGT_EEPROM_SIZE) || + eeprom_option < (struct upgt_eeprom_option *) + sc->sc_eeprom) { return (EINVAL); } @@ -1378,13 +1382,22 @@ eeprom = (struct upgt_lmac_eeprom *)(data->buf + 4); uint16_t eeprom_offset = le16toh(eeprom->offset); uint16_t eeprom_len = le16toh(eeprom->len); + int buf_offset = sizeof(struct upgt_lmac_eeprom) + 4; + if (eeprom_len > MCLBYTES - buf_offset || + eeprom_len > sizeof(sc->sc_eeprom) - eeprom_offset) { + device_printf(sc->sc_dev, + "%s: wrong eeprom length (%u) / offset (%u)!\n", + __func__, eeprom_len, eeprom_offset); + return (NULL); + } + DPRINTF(sc, UPGT_DEBUG_FW, "received EEPROM block (offset=%d, len=%d)\n", eeprom_offset, eeprom_len); memcpy(sc->sc_eeprom + eeprom_offset, - data->buf + sizeof(struct upgt_lmac_eeprom) + 4, + data->buf + buf_offset, eeprom_len); /* EEPROM data has arrived in time, wakeup. */ @@ -1433,7 +1446,7 @@ } static struct mbuf * -upgt_rx(struct upgt_softc *sc, uint8_t *data, int pkglen, int *rssi) +upgt_rx(struct upgt_softc *sc, uint8_t *data, uint16_t pkglen, int *rssi) { struct ieee80211com *ic = &sc->sc_ic; struct upgt_lmac_rx_desc *rxdesc; @@ -1449,9 +1462,14 @@ /* access RX packet descriptor */ rxdesc = (struct upgt_lmac_rx_desc *)data; + if (pkglen >= MCLBYTES - ETHER_ALIGN) { + device_printf(sc->sc_dev, + "%s: A current mbuf storage is small (%d)\n", + __func__, pkglen + ETHER_ALIGN); + return (NULL); + } + /* create mbuf which is suitable for strict alignment archs */ - KASSERT((pkglen + ETHER_ALIGN) < MCLBYTES, - ("A current mbuf storage is small (%d)", pkglen + ETHER_ALIGN)); m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR); if (m == NULL) { device_printf(sc->sc_dev, "could not create RX mbuf\n"); @@ -1701,6 +1719,15 @@ { int i; + if ((uint64_t)(sc->sc_memaddr_frame_start + MCLBYTES) > + sc->sc_memaddr_frame_end) { + device_printf(sc->sc_dev, + "%s: start (%u) + MCLBYTES > end (%u)!\n", + __func__, sc->sc_memaddr_frame_start, + sc->sc_memaddr_frame_end); + return (EINVAL); + } + for (i = 0; i < UPGT_MEMORY_MAX_PAGES; i++) { sc->sc_memory.page[i].used = 0; @@ -1716,6 +1743,14 @@ sc->sc_memory.page[i - 1].addr + MCLBYTES; } + /* Memory wrap check. */ + if (sc->sc_memaddr_frame_start > sc->sc_memory.page[i].addr) { + device_printf(sc->sc_dev, + "%s: frame_start (%u) is too large!\n", + __func__, sc->sc_memaddr_frame_start); + return (EINVAL); + } + if (sc->sc_memory.page[i].addr + MCLBYTES >= sc->sc_memaddr_frame_end) break; @@ -1753,17 +1788,19 @@ /* * Seek to beginning of Boot Record Area (BRA). */ - for (offset = 0; offset < fw->datasize; offset += sizeof(*uc)) { + for (offset = 0; + offset + sizeof(*uc) <= fw->datasize; + offset += sizeof(*uc)) { uc = (const uint32_t *)((const uint8_t *)fw->data + offset); if (*uc == 0) break; } - for (; offset < fw->datasize; offset += sizeof(*uc)) { + for (; offset + sizeof(*uc) <= fw->datasize; offset += sizeof(*uc)) { uc = (const uint32_t *)((const uint8_t *)fw->data + offset); if (*uc != 0) break; } - if (offset == fw->datasize) { + if (offset + sizeof(*uc) > fw->datasize) { device_printf(sc->sc_dev, "firmware Boot Record Area not found\n"); error = EIO; @@ -1776,13 +1813,21 @@ /* * Parse Boot Record Area (BRA) options. */ - while (offset < fw->datasize && bra_end == 0) { + while (offset <= fw->datasize - sizeof(*bra_opt) && bra_end == 0) { /* get current BRA option */ p = (const uint8_t *)fw->data + offset; bra_opt = (const struct upgt_fw_bra_option *)p; bra_option_type = le32toh(bra_opt->type); bra_option_len = le32toh(bra_opt->len) * sizeof(*uc); + if (bra_option_len > (size_t)(fw->datasize - offset - + sizeof(*bra_opt)) || + bra_option_len / sizeof(*uc) != le32toh(bra_opt->len)) { + device_printf(sc->sc_dev, "bra_option_len overflow\n"); + error = EINVAL; + goto fail; + } + switch (bra_option_type) { case UPGT_BRA_TYPE_FW: DPRINTF(sc, UPGT_DEBUG_FW, "UPGT_BRA_TYPE_FW len=%d\n", @@ -1821,6 +1866,18 @@ "UPGT_BRA_TYPE_EXPIF len=%d\n", bra_option_len); break; case UPGT_BRA_TYPE_DESCR: + if (sizeof(*descr) > fw->datasize - offset - + sizeof(*bra_opt) || + sizeof(*descr) > bra_option_len) { + device_printf(sc->sc_dev, "%s: no place for" + "'struct upgt_fw_bra_descr' (%zu / %u)\n", + __func__, + fw->datasize - offset - sizeof(*bra_opt), + bra_option_len); + error = EIO; + goto fail; + } + DPRINTF(sc, UPGT_DEBUG_FW, "UPGT_BRA_TYPE_DESCR len=%d\n", bra_option_len); @@ -2111,14 +2168,28 @@ struct upgt_data *data) { struct ieee80211vap *vap = ni->ni_vap; - int error = 0, len; + int error = 0; struct ieee80211_frame *wh; struct ieee80211_key *k; struct upgt_lmac_mem *mem; struct upgt_lmac_tx_desc *txdesc; + uint32_t len; UPGT_ASSERT_LOCKED(sc); + /* Calculate frame size. */ + len = sizeof(*mem) + sizeof(*txdesc) + m->m_pkthdr.len; + /* We need to align the frame to a 4 byte boundary. */ + len = (len + 3) & ~3; + + if (len > MCLBYTES) { + device_printf(sc->sc_dev, + "%s: the frame %p is too big (%d)\n", + __func__, m, m->m_pkthdr.len); + error = EINVAL; + goto done; + } + upgt_set_led(sc, UPGT_LED_BLINK); /* @@ -2175,19 +2246,14 @@ /* copy frame below our TX descriptor header */ m_copydata(m, 0, m->m_pkthdr.len, data->buf + (sizeof(*mem) + sizeof(*txdesc))); - /* calculate frame size */ - len = sizeof(*mem) + sizeof(*txdesc) + m->m_pkthdr.len; - /* we need to align the frame to a 4 byte boundary */ - len = (len + 3) & ~3; /* calculate frame checksum */ mem->chksum = upgt_chksum_le((uint32_t *)txdesc, len - sizeof(*mem)); data->ni = ni; data->m = m; data->buflen = len; - DPRINTF(sc, UPGT_DEBUG_XMIT, "%s: TX start data sending (%d bytes)\n", + DPRINTF(sc, UPGT_DEBUG_XMIT, "%s: TX start data sending (%u bytes)\n", __func__, len); - KASSERT(len <= MCLBYTES, ("mbuf is small for saving data")); upgt_bulk_tx(sc, data); done: