system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-07 17:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

[iwm] Use IWM_MAX_CMD_PAYLOAD_SIZE to improve command length checks.

Browse source 
Taken-From: OpenBSD (parts of if_iwm.c r1.57 and if_iwmreg.h r1.10)

Obtained from:	DragonflyBSD b70c1eaad06257c5c7f4d8110d21642ebec14f42
This commit is contained in:
Adrian Chadd 2016-06-02 04:53:28 +00:00
parent 00d6aaedf9
commit 7a8b94e1d2
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=301189
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
sys/dev/iwm/if_iwm_util.c
View file

@ -224,7 +224,10 @@ iwm_send_cmd(struct iwm_softc *sc, struct iwm_host_cmd *hcmd)
"large command paylen=%u len0=%u\n",
paylen, hcmd->len[0]);
/* Command is too large */
if (sizeof(cmd->hdr) + paylen > IWM_RBUF_SIZE) {
if (paylen > IWM_MAX_CMD_PAYLOAD_SIZE) {
device_printf(sc->sc_dev,
"firmware command too long (%zd bytes)\n",
paylen + sizeof(cmd->hdr));
error = EINVAL;
goto out;
}
@ -269,7 +272,7 @@ iwm_send_cmd(struct iwm_softc *sc, struct iwm_host_cmd *hcmd)
(unsigned long) (hcmd->len[0] + hcmd->len[1] + sizeof(cmd->hdr)),
async ? " (async)" : "");
if (hcmd->len[0] > sizeof(cmd->data)) {
if (paylen > sizeof(cmd->data)) {
bus_dmamap_sync(ring->data_dmat, data->map,
BUS_DMASYNC_PREWRITE);
} else {

1
sys/dev/iwm/if_iwmreg.h
View file

@ -5243,6 +5243,7 @@ enum iwm_power_scheme {
};
#define IWM_DEF_CMD_PAYLOAD_SIZE 320
#define IWM_MAX_CMD_PAYLOAD_SIZE ((4096 - 4) - sizeof(struct iwm_cmd_header))
#define IWM_CMD_FAILED_MSK 0x40
struct iwm_device_cmd {