wok-current view broadcom-wl64/stuff/017-get-rid-of-get_fs-set_fs-calls.patch @ rev 25687
Up expat CVE-2024-28757
author | Stanislas Leduc <shann@slitaz.org> |
---|---|
date | Fri Mar 15 07:23:20 2024 +0000 (5 months ago) |
parents | |
children |
line source
1 From: Joan Bruguera <joanbrugueram@gmail.com>
2 Date: Sun, 13 Sep 2020 07:33:32 +0200
3 Subject: Get rid of get_fs/set_fs calls in Broadcom WL driver.
4 Origin: https://gist.github.com/joanbm/5c640ac074d27fd1d82c74a5b67a1290
6 Fixes linux-next where get_fs/set_fs is already removed for some architectures.
8 NB: Some checks in wlc_ioctl_internal are likely superfluous,
9 but I'm not familiar enough with the driver to remove them with confidence.
11 See also: https://lwn.net/Articles/722267/
12 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/arch/x86/include/asm/uaccess.h?h=next-20200911&id=47058bb54b57962b3958a936ddbc59355e4c5504
13 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/include/linux/uaccess.h?h=next-20200911&id=5e6e9852d6f76e01b2e6803c74258afa5b432bc5
15 Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
16 ---
17 amd64/src/wl/sys/wl_cfg80211_hybrid.c | 29 ++-----------------------
18 amd64/src/wl/sys/wl_iw.c | 25 ++--------------------
19 amd64/src/wl/sys/wl_linux.c | 40 ++++++++++++++++++++++++++++++-----
20 amd64/src/wl/sys/wl_linux.h | 2 ++
21 amd64/src/wl/sys/wlc_pub.h | 1 +
22 5 files changed, 42 insertions(+), 55 deletions(-)
24 diff --git a/amd64/src/wl/sys/wl_cfg80211_hybrid.c b/amd64/src/wl/sys/wl_cfg80211_hybrid.c
25 index 8e01841..111ec5a 100644
26 --- a/amd64/src/wl/sys/wl_cfg80211_hybrid.c
27 +++ b/amd64/src/wl/sys/wl_cfg80211_hybrid.c
28 @@ -41,6 +41,7 @@
29 #include <wlioctl.h>
30 #include <proto/802.11.h>
31 #include <wl_cfg80211_hybrid.h>
32 +#include <wl_linux.h>
34 #define EVENT_TYPE(e) dtoh32((e)->event_type)
35 #define EVENT_FLAGS(e) dtoh16((e)->flags)
36 @@ -442,30 +443,8 @@
37 static s32
38 wl_dev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len)
39 {
40 - struct ifreq ifr;
41 - struct wl_ioctl ioc;
42 - mm_segment_t fs;
43 - s32 err = 0;
44 -
45 BUG_ON(len < sizeof(int));
46 -
47 - memset(&ioc, 0, sizeof(ioc));
48 - ioc.cmd = cmd;
49 - ioc.buf = arg;
50 - ioc.len = len;
51 - strcpy(ifr.ifr_name, dev->name);
52 - ifr.ifr_data = (caddr_t)&ioc;
53 -
54 - fs = get_fs();
55 - set_fs(get_ds());
56 -#if defined(WL_USE_NETDEV_OPS)
57 - err = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
58 -#else
59 - err = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
60 -#endif
61 - set_fs(fs);
62 -
63 - return err;
64 + return wlc_ioctl_internal(dev, cmd, arg, len);
65 }
67 static s32
68 diff --git a/amd64/src/wl/sys/wl_iw.c b/amd64/src/wl/sys/wl_iw.c
69 index c4c610b..e346b15 100644
70 --- a/amd64/src/wl/sys/wl_iw.c
71 +++ b/amd64/src/wl/sys/wl_iw.c
72 @@ -37,6 +37,7 @@ typedef const struct si_pub si_t;
74 #include <wl_dbg.h>
75 #include <wl_iw.h>
76 +#include <wl_linux.h>
78 extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
79 uint32 reason, char* stringBuf, uint buflen);
80 @@ -103,29 +104,7 @@ dev_wlc_ioctl(
81 int len
82 )
83 {
84 - struct ifreq ifr;
85 - wl_ioctl_t ioc;
86 - mm_segment_t fs;
87 - int ret;
88 -
89 - memset(&ioc, 0, sizeof(ioc));
90 - ioc.cmd = cmd;
91 - ioc.buf = arg;
92 - ioc.len = len;
93 -
94 - strcpy(ifr.ifr_name, dev->name);
95 - ifr.ifr_data = (caddr_t) &ioc;
96 -
97 - fs = get_fs();
98 - set_fs(get_ds());
99 -#if defined(WL_USE_NETDEV_OPS)
100 - ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
101 -#else
102 - ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
103 -#endif
104 - set_fs(fs);
105 -
106 - return ret;
107 + return wlc_ioctl_internal(dev, cmd, arg, len);
108 }
110 static int
111 diff --git a/amd64/src/wl/sys/wl_linux.c b/amd64/src/wl/sys/wl_linux.c
112 index 66069d4..cc01d2b 100644
113 --- a/amd64/src/wl/sys/wl_linux.c
114 +++ b/amd64/src/wl/sys/wl_linux.c
115 @@ -1661,10 +1661,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
116 goto done2;
117 }
119 - if (segment_eq(get_fs(), KERNEL_DS))
120 - buf = ioc.buf;
121 -
122 - else if (ioc.buf) {
123 + if (ioc.buf) {
124 if (!(buf = (void *) MALLOC(wl->osh, MAX(ioc.len, WLC_IOCTL_MAXLEN)))) {
125 bcmerror = BCME_NORESOURCE;
126 goto done2;
127 @@ -1681,7 +1678,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
128 WL_UNLOCK(wl);
130 done1:
131 - if (ioc.buf && (ioc.buf != buf)) {
132 + if (ioc.buf) {
133 if (copy_to_user(ioc.buf, buf, ioc.len))
134 bcmerror = BCME_BADADDR;
135 MFREE(wl->osh, buf, MAX(ioc.len, WLC_IOCTL_MAXLEN));
136 @@ -1694,6 +1691,39 @@ done2:
137 return (OSL_ERROR(bcmerror));
138 }
140 +int
141 +wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len)
142 +{
143 + wl_info_t *wl;
144 + wl_if_t *wlif;
145 + int bcmerror;
146 +
147 + if (!dev)
148 + return -ENETDOWN;
149 +
150 + wl = WL_INFO(dev);
151 + wlif = WL_DEV_IF(dev);
152 + if (wlif == NULL || wl == NULL || wl->dev == NULL)
153 + return -ENETDOWN;
154 +
155 + bcmerror = 0;
156 +
157 + WL_TRACE(("wl%d: wlc_ioctl_internal: cmd 0x%x\n", wl->pub->unit, cmd));
158 +
159 + WL_LOCK(wl);
160 + if (!capable(CAP_NET_ADMIN)) {
161 + bcmerror = BCME_EPERM;
162 + } else {
163 + bcmerror = wlc_ioctl(wl->wlc, cmd, buf, len, wlif->wlcif);
164 + }
165 + WL_UNLOCK(wl);
166 +
167 + ASSERT(VALID_BCMERROR(bcmerror));
168 + if (bcmerror != 0)
169 + wl->pub->bcmerror = bcmerror;
170 + return (OSL_ERROR(bcmerror));
171 +}
172 +
173 static struct net_device_stats*
174 wl_get_stats(struct net_device *dev)
175 {
176 diff --git a/amd64/src/wl/sys/wl_linux.h b/amd64/src/wl/sys/wl_linux.h
177 index 5b1048e..c8c1f41 100644
178 --- a/amd64/src/wl/sys/wl_linux.h
179 +++ b/amd64/src/wl/sys/wl_linux.h
180 @@ -22,6 +22,7 @@
181 #define _wl_linux_h_
183 #include <wlc_types.h>
184 +#include <wlc_pub.h>
186 typedef struct wl_timer {
187 struct timer_list timer;
188 @@ -187,6 +188,7 @@ extern irqreturn_t wl_isr(int irq, void *dev_id, struct pt_regs *ptregs);
189 extern int __devinit wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
190 extern void wl_free(wl_info_t *wl);
191 extern int wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
192 +extern int wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len);
193 extern struct net_device * wl_netdev_get(wl_info_t *wl);
195 #endif
196 diff --git a/amd64/src/wl/sys/wlc_pub.h b/amd64/src/wl/sys/wlc_pub.h
197 index 53a98b8..2b5a029 100644
198 --- a/amd64/src/wl/sys/wlc_pub.h
199 +++ b/amd64/src/wl/sys/wlc_pub.h
200 @@ -24,6 +24,7 @@
202 #include <wlc_types.h>
203 #include <wlc_utils.h>
204 +#include <siutils.h>
205 #include "proto/802.11.h"
206 #include "proto/bcmevent.h"