package/kernel/mac80211/patches/381-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch

   1 From e0a8ef4d7b4315bc4c1641fb3f3a7dfdfa6627b8 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
   3 Date: Wed, 20 Feb 2019 11:30:47 +0100
   4 Subject: [PATCH] brcmfmac: add basic validation of shared RAM address
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 While experimenting with firmware loading I ended up in a state of
  10 firmware reporting shared RAM address 0x04000001. It was causing:
  11 [   94.448015] Unable to handle kernel paging request at virtual address cd680001
  12 due to reading out of the mapped memory.
  13
  14 This patch adds some basic validation to avoid kernel crashes due to the
  15 unexpected firmware behavior.
  16
  17 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  18 Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  19 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  20 ---
  21  drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++++
  22  1 file changed, 6 insertions(+)
  23
  24 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
  25 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
  26 @@ -1560,6 +1560,12 @@ static int brcmf_pcie_download_fw_nvram(
  27                 brcmf_err(bus, "FW failed to initialize\n");
  28                 return -ENODEV;
  29         }
  30 +       if (sharedram_addr < devinfo->ci->rambase ||
  31 +           sharedram_addr >= devinfo->ci->rambase + devinfo->ci->ramsize) {
  32 +               brcmf_err(bus, "Invalid shared RAM address 0x%08x\n",
  33 +                         sharedram_addr);
  34 +               return -ENODEV;
  35 +       }
  36         brcmf_dbg(PCIE, "Shared RAM addr: 0x%08x\n", sharedram_addr);
  37
  38         return (brcmf_pcie_init_share_ram_info(devinfo, sharedram_addr));