Page MenuHomeFreeBSD
Files F163401131

D58307.id182144.diff
No OneTemporary
Actions

D58307.id182144.diff
View Options

diff --git a/sys/dev/firewire/firewire.c b/sys/dev/firewire/firewire.c
--- a/sys/dev/firewire/firewire.c
+++ b/sys/dev/firewire/firewire.c
@@ -1519,7 +1519,11 @@
if (err)
return (-1);
- /* TODO: validate directory CRC */
+ if (!crom_crc_valid((uint32_t *)reg, dir->crc_len, dir->crc)) {
+ if (firewire_debug)
+ printf("%s: bad CRC in directory at 0x%x\n",
+ __func__, offset - (int)sizeof(uint32_t));
+ }
off = CSRROMOFF + offset + sizeof(uint32_t) * (dir->crc_len - 1);
if (fwdev->rommax < off)
@@ -1586,6 +1590,7 @@
return (-1);
}
binfo = (struct bus_info *)&csr[1];
+ /* Root header CRC spans entire ROM; validated per-directory below. */
if (binfo->bus_name != CSR_BUS_NAME_IEEE1394) {
dfwdev->status = FWDEVINVAL;
return (-1);
@@ -1828,6 +1833,10 @@
root_len = rootdir->crc_len;
if (root_off + 1 + root_len > rom_quads)
return;
+ if (!crom_crc_valid((uint32_t *)&rootdir->entry[0], root_len,
+ rootdir->crc) && firewire_debug)
+ device_printf(fwdev->fc->bdev,
+ "fw_parse_units: bad root directory CRC\n");
uindex = 0;
for (ri = 0; ri < (int)root_len; ri++) {
@@ -1844,6 +1853,10 @@
udir_len = udir->crc_len;
if (udir_qoff + 1 + udir_len > rom_quads)
continue;
+ if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len,
+ udir->crc) && firewire_debug)
+ printf("fw_parse_units: bad CRC in unit dir at 0x%x\n",
+ udir_qoff);
spec_id = 0;
sw_version = 0;
diff --git a/sys/dev/firewire/fwcam.c b/sys/dev/firewire/fwcam.c
--- a/sys/dev/firewire/fwcam.c
+++ b/sys/dev/firewire/fwcam.c
@@ -98,6 +98,11 @@
dir_len = dir->crc_len;
if (dir_qoff + 1 + dir_len > rom_quads)
return (0);
+ if (!crom_crc_valid((uint32_t *)&dir->entry[0], dir_len, dir->crc)) {
+ if (firewire_debug)
+ printf("fwcam: bad CRC in directory at 0x%x\n",
+ dir_qoff);
+ }
for (i = 0; i < (int)dir_len; i++) {
if (dir_qoff + 1 + i >= rom_quads)
diff --git a/sys/dev/firewire/fwcrom.c b/sys/dev/firewire/fwcrom.c
--- a/sys/dev/firewire/fwcrom.c
+++ b/sys/dev/firewire/fwcrom.c
@@ -237,6 +237,13 @@
return ((uint16_t) crc);
}
+int
+crom_crc_valid(uint32_t *data, int len, uint16_t expected)
+{
+
+ return (crom_crc(data, len) == expected);
+}
+
#if !defined(_KERNEL) && !defined(_BOOT)
static void
crom_desc_specver(uint32_t spec, uint32_t ver, char *buf, int len)
diff --git a/sys/dev/firewire/fwisound.c b/sys/dev/firewire/fwisound.c
--- a/sys/dev/firewire/fwisound.c
+++ b/sys/dev/firewire/fwisound.c
@@ -123,6 +123,11 @@
udir_len = udir->crc_len;
if (udir_qoff + 1 + udir_len > rom_quads)
return (0);
+ if (!crom_crc_valid((uint32_t *)&udir->entry[0], udir_len, udir->crc)) {
+ if (firewire_debug)
+ printf("fwisound: bad CRC in unit directory at 0x%x\n",
+ udir_qoff);
+ }
for (i = 0; i < (int)udir_len; i++) {
if (udir_qoff + 1 + i >= rom_quads)
diff --git a/sys/dev/firewire/iec13213.h b/sys/dev/firewire/iec13213.h
--- a/sys/dev/firewire/iec13213.h
+++ b/sys/dev/firewire/iec13213.h
@@ -215,6 +215,7 @@
void crom_next(struct crom_context *);
void crom_parse_text(struct crom_context *, char *, int);
uint16_t crom_crc(uint32_t *r, int);
+int crom_crc_valid(uint32_t *data, int len, uint16_t expected);
struct csrreg *crom_search_key(struct crom_context *, uint8_t);
int crom_has_specver(uint32_t *, uint32_t, uint32_t);

File Metadata

Mime Type
text/plain
Expires
Thu, Jul 23, 9:24 PM (12 h, 6 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35285781
Default Alt Text
D58307.id182144.diff (3 KB)

Event Timeline