brcmfmac: firmware: Fix crash in brcm_alt_fw_path

PATCH In review Phil Elwell 3 participants 12 messages Jan 18, 2022 – Jan 28, 2022 Broadcom BRCM80211 IEEE802.11 wireless drivers

lore

Share & tools

lore

Phil Elwell

author

2022-01-18 15:45 UTC #0 lore raw

PATCH 1/1 brcmfmac: firmware: Fix crash in brcm_alt_fw_path

The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.

Prevent the crash by adding the necessary check.

See: https://github.com/raspberrypi/linux/issues/4833

Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")

Signed-off-by Phil Elwell <[email protected]>

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +4 -2

index 0eb13e5df5177..d99140960a820 100644
@@ -693,7 +693,7 @@ int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
 {
 	struct brcmf_fw_item *first = &req->items[0];
 	struct brcmf_fw *fwctx;
-	char *alt_path;
+	char *alt_path = NULL;
 	int ret;
 
 	brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));

@@ -712,7 +712,9 @@ int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
 	fwctx->done = fw_cb;
 
 	/* First try alternative board-specific path if any */
-	alt_path = brcm_alt_fw_path(first->path, fwctx->req->board_type);
+	if (fwctx->req->board_type)
+		alt_path = brcm_alt_fw_path(first->path,
+					    fwctx->req->board_type);
 	if (alt_path) {
 		ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
 					      fwctx->dev, GFP_KERNEL, fwctx,

Signature · 1 line

2.25.1

Kalle Valo

2022-01-19 06:01 UTC #1 lore raw

Quoted 11 lines · Phil Elwell

The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by Phil Elwell <[email protected]>

I think this should go to v5.17.

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Phil Elwell

author

2022-01-19 08:54 UTC #2 lore raw

Quoted 7 lines · Kalle Valo

Quoted 5 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.

Quoted 8 lines

Quoted 6 lines
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.

Is that an Ack? Are you asking me to submit the patch in a different way?

Phil

Kalle Valo

2022-01-19 10:00 UTC #3 lore raw

Quoted 10 lines · Phil Elwell

Quoted 9 lines · Kalle Valo
Quoted 7 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.
Is that an Ack?

It's a note to myself and other maintainers/reviewers that I'm planning to take this to the wireless tree. At the moment I'm waiting for other people to comment.

Quoted 1 line

Are you asking me to submit the patch in a different way?

No need, unless something is found during review.

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Arend van Spriel

maintainer

2022-01-19 15:48 UTC #4 lore raw

In reply to Phil Elwell

Quoted 10 lines · Phil Elwell

Quoted 9 lines · Kalle Valo
Quoted 7 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?

Similar/same patch was submitted by Hector Martin [1].

Regards,
Arend

[1] https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

Kalle Valo

2022-01-27 12:08 UTC #5 lore raw

Quoted 21 lines · Arend van Spriel

Quoted 12 lines · Phil Elwell
Quoted 11 lines · Kalle Valo
Quoted 9 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Quoted 7 lines
Quoted 5 lines
Quoted 3 lines
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?

Quoted 7 lines

Similar/same patch was submitted by Hector Martin [1].
Regards,
Arend
[1]
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

I would prefer to take this patch to wireless tree and drop Hector's version. Is that ok?

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Arend van Spriel

maintainer

2022-01-27 13:00 UTC #6 lore raw

Quoted 19 lines · Kalle Valo

Quoted 17 lines · Arend van Spriel
Quoted 16 lines · Phil Elwell
Quoted 15 lines · Kalle Valo
Quoted 12 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>

Quoted 5 lines

Quoted 5 lines
Quoted 3 lines
Quoted 1 line
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?
Similar/same patch was submitted by Hector Martin [1].

Fine by me. Hector's subset series (fixes) is ready to be taken as well, right?

Regards,
Arend

Kalle Valo

2022-01-27 13:17 UTC #7 lore raw

Quoted 20 lines · Arend van Spriel

Quoted 19 lines · Kalle Valo
Quoted 17 lines · Arend van Spriel
Quoted 16 lines · Phil Elwell
Quoted 15 lines · Kalle Valo
Quoted 12 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>

Quoted 8 lines

Quoted 5 lines
Quoted 5 lines
Quoted 3 lines
Quoted 1 line
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?
Similar/same patch was submitted by Hector Martin [1].
Fine by me. Hector's subset series (fixes) is ready to be taken as well, right?

I have not looked at Hector's patches yet, my plan is to take them to wireless-next.

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Arend van Spriel

maintainer

2022-01-27 14:30 UTC #8 lore raw

Quoted 26 lines · Kalle Valo

Quoted 24 lines · Arend van Spriel
Quoted 23 lines · Kalle Valo
Quoted 21 lines · Arend van Spriel
Quoted 19 lines · Phil Elwell
Quoted 9 lines · Kalle Valo
Quoted 7 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
Quoted 7 lines
Quoted 5 lines
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?

Quoted 7 lines

Quoted 4 lines
Quoted 1 line
Quoted 1 line
Similar/same patch was submitted by Hector Martin [1].
Fine by me. Hector's subset series (fixes) is ready to be taken as well, right?
I have not looked at Hector's patches yet, my plan is to take them to wireless-next.

Some of them are improvements so wireless-next is where those belong, but a few (patches #1-3, and #6) are actual bug fixes.

Regards,
Arend

Kalle Valo

2022-01-27 15:36 UTC #9 lore raw

Quoted 29 lines · Arend van Spriel

Quoted 28 lines · Kalle Valo
Quoted 26 lines · Arend van Spriel
Quoted 24 lines · Kalle Valo
Quoted 22 lines · Arend van Spriel
Quoted 12 lines · Phil Elwell
Quoted 11 lines · Kalle Valo
Quoted 9 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Quoted 7 lines
Quoted 5 lines
Quoted 3 lines
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?
Similar/same patch was submitted by Hector Martin [1].

Quoted 8 lines

Quoted 5 lines
Quoted 2 lines
Fine by me. Hector's subset series (fixes) is ready to be taken as well, right?
I have not looked at Hector's patches yet, my plan is to take them to wireless-next.
Some of them are improvements so wireless-next is where those belong, but a few (patches #1-3, and #6) are actual bug fixes.

To avoid conflicts I'm keeping the bar high for patches going to wireless, so it's mostly regression fixes or otherwise important fixes.

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Arend van Spriel

maintainer

2022-01-27 16:22 UTC #10 lore raw

Quoted 34 lines · Kalle Valo

Quoted 32 lines · Arend van Spriel
Quoted 31 lines · Kalle Valo
Quoted 28 lines · Arend van Spriel
Quoted 19 lines · Kalle Valo
Quoted 17 lines · Arend van Spriel
Quoted 16 lines · Phil Elwell
Quoted 15 lines · Kalle Valo
Quoted 12 lines · Phil Elwell
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware
binaries")
Signed-off-by Phil Elwell <[email protected]>
Quoted 5 lines
Quoted 5 lines
Quoted 3 lines
Quoted 1 line
I think this should go to v5.17.
Is that an Ack? Are you asking me to submit the patch in a different way?
Similar/same patch was submitted by Hector Martin [1].
Fine by me. Hector's subset series (fixes) is ready to be taken as well, right?

Quoted 8 lines

Quoted 5 lines
Quoted 2 lines
I have not looked at Hector's patches yet, my plan is to take them to wireless-next.
Some of them are improvements so wireless-next is where those belong, but a few (patches #1-3, and #6) are actual bug fixes.
To avoid conflicts I'm keeping the bar high for patches going to wireless, so it's mostly regression fixes or otherwise important fixes.

Understood. No problem.

Regards,
Arend

Kalle Valo

2022-01-28 14:07 UTC #11 lore raw

In reply to Phil Elwell

Quoted 11 lines · Phil Elwell

The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected by a check to the validity of the fwctx->req->board_type pointer. This results in a crash in strlcat when, for example, the WLAN chip is found in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by Phil Elwell <[email protected]>

Patch applied to wireless.git, thanks.

665408f4c3a5 brcmfmac: firmware: Fix crash in brcm_alt_fw_path

Signature · 3 lines

https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches