wok-current view broadcom-wl64/stuff/018-linux59.patch @ rev 25687
Up expat CVE-2024-28757
author | Stanislas Leduc <shann@slitaz.org> |
---|---|
date | Fri Mar 15 07:23:20 2024 +0000 (5 months ago) |
parents | |
children |
line source
1 From f3d652840f8dd959395065a1cf67ca40b04ec69b Mon Sep 17 00:00:00 2001
2 From: Joan Bruguera <joanbrugueram@gmail.com>
3 Date: Tue, 13 Oct 2020 19:35:55 +0200
4 Subject: [PATCH] Get rid of get_fs/set_fs calls in Broadcom WL driver.
6 Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 5.10 (tested -rc1 up to 5.10.1)
8 Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-23 on Arch Linux.
10 NB: Some checks in wlc_ioctl_internal are likely superfluous,
11 but I'm not familiar enough with the driver to remove them with confidence.
13 See also: https://lwn.net/Articles/722267/
14 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47058bb54b57962b3958a936ddbc59355e4c5504
15 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5e6e9852d6f76e01b2e6803c74258afa5b432bc5
17 Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
18 ---
19 src/wl/sys/wl_cfg80211_hybrid.c | 25 ++-------------------
20 src/wl/sys/wl_iw.c | 25 ++-------------------
21 src/wl/sys/wl_linux.c | 40 ++++++++++++++++++++++++++++-----
22 src/wl/sys/wl_linux.h | 2 ++
23 src/wl/sys/wlc_pub.h | 1 +
24 5 files changed, 42 insertions(+), 51 deletions(-)
26 diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
27 index 7b606e0..1e0adb7 100644
28 --- a/src/wl/sys/wl_cfg80211_hybrid.c
29 +++ b/src/wl/sys/wl_cfg80211_hybrid.c
30 @@ -38,6 +38,7 @@
31 #include <wlioctl.h>
32 #include <proto/802.11.h>
33 #include <wl_cfg80211_hybrid.h>
34 +#include <wl_linux.h>
36 #define EVENT_TYPE(e) dtoh32((e)->event_type)
37 #define EVENT_FLAGS(e) dtoh16((e)->flags)
38 @@ -435,30 +436,7 @@ static void key_endian_to_host(struct wl_wsec_key *key)
39 static s32
40 wl_dev_ioctl(struct net_device *dev, u32 cmd, void *arg, u32 len)
41 {
42 - struct ifreq ifr;
43 - struct wl_ioctl ioc;
44 - mm_segment_t fs;
45 - s32 err = 0;
46 -
47 - BUG_ON(len < sizeof(int));
48 -
49 - memset(&ioc, 0, sizeof(ioc));
50 - ioc.cmd = cmd;
51 - ioc.buf = arg;
52 - ioc.len = len;
53 - strcpy(ifr.ifr_name, dev->name);
54 - ifr.ifr_data = (caddr_t)&ioc;
55 -
56 - fs = get_fs();
57 - set_fs(get_ds());
58 -#if defined(WL_USE_NETDEV_OPS)
59 - err = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
60 -#else
61 - err = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
62 -#endif
63 - set_fs(fs);
64 -
65 - return err;
66 + return wlc_ioctl_internal(dev, cmd, arg, len);
67 }
69 static s32
70 diff --git a/src/wl/sys/wl_iw.c b/src/wl/sys/wl_iw.c
71 index c4c610b..e346b15 100644
72 --- a/src/wl/sys/wl_iw.c
73 +++ b/src/wl/sys/wl_iw.c
74 @@ -37,6 +37,7 @@ typedef const struct si_pub si_t;
76 #include <wl_dbg.h>
77 #include <wl_iw.h>
78 +#include <wl_linux.h>
80 extern bool wl_iw_conn_status_str(uint32 event_type, uint32 status,
81 uint32 reason, char* stringBuf, uint buflen);
82 @@ -103,29 +104,7 @@ dev_wlc_ioctl(
83 int len
84 )
85 {
86 - struct ifreq ifr;
87 - wl_ioctl_t ioc;
88 - mm_segment_t fs;
89 - int ret;
90 -
91 - memset(&ioc, 0, sizeof(ioc));
92 - ioc.cmd = cmd;
93 - ioc.buf = arg;
94 - ioc.len = len;
95 -
96 - strcpy(ifr.ifr_name, dev->name);
97 - ifr.ifr_data = (caddr_t) &ioc;
98 -
99 - fs = get_fs();
100 - set_fs(get_ds());
101 -#if defined(WL_USE_NETDEV_OPS)
102 - ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
103 -#else
104 - ret = dev->do_ioctl(dev, &ifr, SIOCDEVPRIVATE);
105 -#endif
106 - set_fs(fs);
107 -
108 - return ret;
109 + return wlc_ioctl_internal(dev, cmd, arg, len);
110 }
112 static int
113 diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
114 index 947cef3..f04c148 100644
115 --- a/src/wl/sys/wl_linux.c
116 +++ b/src/wl/sys/wl_linux.c
117 @@ -1643,10 +1643,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
118 goto done2;
119 }
121 - if (segment_eq(get_fs(), KERNEL_DS))
122 - buf = ioc.buf;
123 -
124 - else if (ioc.buf) {
125 + if (ioc.buf) {
126 if (!(buf = (void *) MALLOC(wl->osh, MAX(ioc.len, WLC_IOCTL_MAXLEN)))) {
127 bcmerror = BCME_NORESOURCE;
128 goto done2;
129 @@ -1667,7 +1664,7 @@ wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
130 WL_UNLOCK(wl);
132 done1:
133 - if (ioc.buf && (ioc.buf != buf)) {
134 + if (ioc.buf) {
135 if (copy_to_user(ioc.buf, buf, ioc.len))
136 bcmerror = BCME_BADADDR;
137 MFREE(wl->osh, buf, MAX(ioc.len, WLC_IOCTL_MAXLEN));
138 @@ -1680,6 +1677,39 @@ done2:
139 return (OSL_ERROR(bcmerror));
140 }
142 +int
143 +wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len)
144 +{
145 + wl_info_t *wl;
146 + wl_if_t *wlif;
147 + int bcmerror;
148 +
149 + if (!dev)
150 + return -ENETDOWN;
151 +
152 + wl = WL_INFO(dev);
153 + wlif = WL_DEV_IF(dev);
154 + if (wlif == NULL || wl == NULL || wl->dev == NULL)
155 + return -ENETDOWN;
156 +
157 + bcmerror = 0;
158 +
159 + WL_TRACE(("wl%d: wlc_ioctl_internal: cmd 0x%x\n", wl->pub->unit, cmd));
160 +
161 + WL_LOCK(wl);
162 + if (!capable(CAP_NET_ADMIN)) {
163 + bcmerror = BCME_EPERM;
164 + } else {
165 + bcmerror = wlc_ioctl(wl->wlc, cmd, buf, len, wlif->wlcif);
166 + }
167 + WL_UNLOCK(wl);
168 +
169 + ASSERT(VALID_BCMERROR(bcmerror));
170 + if (bcmerror != 0)
171 + wl->pub->bcmerror = bcmerror;
172 + return (OSL_ERROR(bcmerror));
173 +}
174 +
175 static struct net_device_stats*
176 wl_get_stats(struct net_device *dev)
177 {
178 diff --git a/src/wl/sys/wl_linux.h b/src/wl/sys/wl_linux.h
179 index 5b1048e..c8c1f41 100644
180 --- a/src/wl/sys/wl_linux.h
181 +++ b/src/wl/sys/wl_linux.h
182 @@ -22,6 +22,7 @@
183 #define _wl_linux_h_
185 #include <wlc_types.h>
186 +#include <wlc_pub.h>
188 typedef struct wl_timer {
189 struct timer_list timer;
190 @@ -187,6 +188,7 @@ extern irqreturn_t wl_isr(int irq, void *dev_id, struct pt_regs *ptregs);
191 extern int __devinit wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent);
192 extern void wl_free(wl_info_t *wl);
193 extern int wl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
194 +extern int wlc_ioctl_internal(struct net_device *dev, int cmd, void *buf, int len);
195 extern struct net_device * wl_netdev_get(wl_info_t *wl);
197 #endif
198 diff --git a/src/wl/sys/wlc_pub.h b/src/wl/sys/wlc_pub.h
199 index 53a98b8..2b5a029 100644
200 --- a/src/wl/sys/wlc_pub.h
201 +++ b/src/wl/sys/wlc_pub.h
202 @@ -24,6 +24,7 @@
204 #include <wlc_types.h>
205 #include <wlc_utils.h>
206 +#include <siutils.h>
207 #include "proto/802.11.h"
208 #include "proto/bcmevent.h"
210 --
211 2.28.0