shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 11:26:02 +09:00
Code Issues Packages Projects Releases Wiki Activity

net: wireless: rockchip_wlan: realtek wifi: avoid illegal argument when called by ioctl SIOCDEVPRIVATE

Browse Source 
Illegal argument will cause following kernel panic.

Call trace:
  PHY_SetRFReg_8723B
  rtw_hal_write_rfreg
  rtw_wx_write_rf
  _rtw_ioctl_wext_private
  rtw_ioctl
  dev_ifsioc
  dev_ioctl

References: CNVD-C-2020-259508
Signed-off-by: Weiguo Hu <hwg@rock-chips.com>
Change-Id: Ia493d8276c1dd414c184a9b3eddb5d252bd85b98
This commit is contained in:
Weiguo Hu
2020-11-12 08:41:45 +08:00
committed by Tao Huang
parent 21f2c43755
commit 103827124a
8 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/rockchip_wlan/rtl8188eu/hal/rtl8188e/rtl8188e_phycfg.c
View File

@@ -571,6 +571,9 @@ phy_RFSerialWrite(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
#if 0
/* <Roger_TODO> We should check valid regs for RF_6052 case. */
if (pHalData->RFChipID == RF_8225 && Offset > 0x24) /* 36 valid regs */

3
drivers/net/wireless/rockchip_wlan/rtl8188fu/hal/rtl8188f/rtl8188f_phycfg.c
View File

@@ -339,6 +339,9 @@ phy_RFSerialWrite_8188F(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;
/* */

3
drivers/net/wireless/rockchip_wlan/rtl8189es/hal/rtl8188e/rtl8188e_phycfg.c
View File

@@ -581,6 +581,9 @@ phy_RFSerialWrite(
HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
#if 0
//<Roger_TODO> We should check valid regs for RF_6052 case.

3
drivers/net/wireless/rockchip_wlan/rtl8189fs/hal/rtl8188f/rtl8188f_phycfg.c
View File

@@ -277,6 +277,9 @@ phy_RFSerialWrite_8188F(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;
/* */

3
drivers/net/wireless/rockchip_wlan/rtl8723bs/hal/rtl8723b/rtl8723b_phycfg.c
View File

@@ -333,6 +333,9 @@ phy_RFSerialWrite_8723B(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;
/* */

4
drivers/net/wireless/rockchip_wlan/rtl8723bu/hal/rtl8723b/rtl8723b_phycfg.c
View File

@@ -344,6 +344,10 @@ phy_RFSerialWrite_8723B(
HAL_DATA_TYPE *pHalData = GET_HAL_DATA(Adapter);
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;

3
drivers/net/wireless/rockchip_wlan/rtl8723cs/hal/rtl8703b/rtl8703b_phycfg.c
View File

@@ -277,6 +277,9 @@ phy_RFSerialWrite_8703B(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;
/* */

5
drivers/net/wireless/rockchip_wlan/rtl8723ds/hal/rtl8723d/rtl8723d_phycfg.c
View File

@@ -278,6 +278,9 @@ phy_RFSerialWrite_8723D(
BB_REGISTER_DEFINITION_T *pPhyReg = &pHalData->PHYRegDef[eRFPath];
u32 NewOffset;
if (eRFPath >= MAX_RF_PATH)
return;
Offset &= 0xff;
/* */
@@ -1191,4 +1194,4 @@ PHY_SetSwChnlBWMode8723D(
/* RTW_INFO("<==%s()\n",__FUNCTION__); */
}