lkml.org 
[lkml]   [2008]   [Jun]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] isight_firmware: Avoid crash on loading invalid firmware
    On Fri, Jun 6, 2008 at 7:48 PM, Matthew Garrett <mjg59@srcf.ucam.org> wrote:
    > Different tools generate slightly different formats of the isight
    > firmware. Ensure that the firmware buffer is not overrun, while still
    > ensuring that the correct amount of data is written if trailing data is
    > preseent. Fixes crash reported by Justin Mattock.
    >
    > Signed-off-by: Matthew Garrett <mjg@redhat.com>
    >
    > ---
    >
    > Identical to the previous patch, just acknowledges Justin Mattock's (not
    > Maddock, Andrew :p) report in the changelog.
    >
    > diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
    > index 390e048..9f30aa1 100644
    > --- a/drivers/usb/misc/isight_firmware.c
    > +++ b/drivers/usb/misc/isight_firmware.c
    > @@ -39,9 +39,12 @@ static int isight_firmware_load(struct usb_interface *intf,
    > struct usb_device *dev = interface_to_usbdev(intf);
    > int llen, len, req, ret = 0;
    > const struct firmware *firmware;
    > - unsigned char *buf;
    > + unsigned char *buf = kmalloc(50, GFP_KERNEL);
    > unsigned char data[4];
    > - char *ptr;
    > + u8 *ptr;
    > +
    > + if (!buf)
    > + return -ENOMEM;
    >
    > if (request_firmware(&firmware, "isight.fw", &dev->dev) != 0) {
    > printk(KERN_ERR "Unable to load isight firmware\n");
    > @@ -59,7 +62,7 @@ static int isight_firmware_load(struct usb_interface *intf,
    > goto out;
    > }
    >
    > - while (1) {
    > + while (ptr+4 <= firmware->data+firmware->size) {
    > memcpy(data, ptr, 4);
    > len = (data[0] << 8 | data[1]);
    > req = (data[2] << 8 | data[3]);
    > @@ -71,10 +74,14 @@ static int isight_firmware_load(struct usb_interface *intf,
    > continue;
    >
    > for (; len > 0; req += 50) {
    > - llen = len > 50 ? 50 : len;
    > + llen = min(len, 50);
    > len -= llen;
    > -
    > - buf = kmalloc(llen, GFP_KERNEL);
    > + if (ptr+llen > firmware->data+firmware->size) {
    > + printk(KERN_ERR
    > + "Malformed isight firmware");
    > + ret = -ENODEV;
    > + goto out;
    > + }
    > memcpy(buf, ptr, llen);
    >
    > ptr += llen;
    > @@ -89,16 +96,18 @@ static int isight_firmware_load(struct usb_interface *intf,
    > goto out;
    > }
    >
    > - kfree(buf);
    > }
    > }
    > +
    > if (usb_control_msg
    > (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
    > 300) != 1) {
    > printk(KERN_ERR "isight firmware loading completion failed\n");
    > ret = -ENODEV;
    > }
    > +
    > out:
    > + kfree(buf);
    > release_firmware(firmware);
    > return ret;
    > }
    >
    > --
    > Matthew Garrett | mjg59@srcf.ucam.org
    >

    Also not matlock(not the T.V. show). Now onto the status: I think
    there might be something going on with this patch, or the module
    itself I keep getting ACPI EC: GPE storm
    detected(http://bugzilla.kernel.org/show_bug.cgi?id=10724) , yesterday
    I modified drivers/acpi/ec.c and was not receiving this message the
    rest of the day, after applying the patch to isight_firmware and
    loading, I'm receiving this message probably within 20 minutes of
    being up. Now I'm not sure If it's because I modified ec.c, or not
    that's causing this. I'll have to run a couple of experiments to see.
    has anybody seen the same message?
    regards;

    --
    Justin P. Mattock


    \
     
     \ /
      Last update: 2008-06-06 23:17    [W:0.028 / U:0.624 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site