Commit 8d7802ed authored by matthieu castet's avatar matthieu castet Committed by Greg Kroah-Hartman
Browse files

[PATCH] USB: Eagle and ADI 930 usb adsl modem driver fix



More care on loading firmware, take into account fw->size can't be zero.
Signed-off-by: default avatarMatthieu CASTET <castet.matthieu@free.fr>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent b72458a8
...@@ -426,14 +426,14 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte ...@@ -426,14 +426,14 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte
pfw = fw_entry->data; pfw = fw_entry->data;
size = fw_entry->size; size = fw_entry->size;
if (size < 4)
goto err_fw_corrupted;
crc = FW_GET_LONG(pfw); crc = FW_GET_LONG(pfw);
pfw += 4; pfw += 4;
size -= 4; size -= 4;
if (crc32_be(0, pfw, size) != crc) { if (crc32_be(0, pfw, size) != crc)
uea_err(usb, "firmware is corrupted\n"); goto err_fw_corrupted;
goto err;
}
/* /*
* Start to upload formware : send reset * Start to upload formware : send reset
...@@ -446,9 +446,14 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte ...@@ -446,9 +446,14 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte
goto err; goto err;
} }
while (size > 0) { while (size > 3) {
u8 len = FW_GET_BYTE(pfw); u8 len = FW_GET_BYTE(pfw);
u16 add = FW_GET_WORD(pfw + 1); u16 add = FW_GET_WORD(pfw + 1);
size -= len + 3;
if (size < 0)
goto err_fw_corrupted;
ret = uea_send_modem_cmd(usb, add, len, pfw + 3); ret = uea_send_modem_cmd(usb, add, len, pfw + 3);
if (ret < 0) { if (ret < 0) {
uea_err(usb, "uploading firmware data failed " uea_err(usb, "uploading firmware data failed "
...@@ -456,9 +461,11 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte ...@@ -456,9 +461,11 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte
goto err; goto err;
} }
pfw += len + 3; pfw += len + 3;
size -= len + 3;
} }
if (size != 0)
goto err_fw_corrupted;
/* /*
* Tell the modem we finish : de-assert reset * Tell the modem we finish : de-assert reset
*/ */
...@@ -469,6 +476,11 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte ...@@ -469,6 +476,11 @@ static void uea_upload_pre_firmware(const struct firmware *fw_entry, void *conte
else else
uea_info(usb, "firmware uploaded\n"); uea_info(usb, "firmware uploaded\n");
uea_leaves(usb);
return;
err_fw_corrupted:
uea_err(usb, "firmware is corrupted\n");
err: err:
uea_leaves(usb); uea_leaves(usb);
} }
...@@ -522,10 +534,6 @@ static int check_dsp(u8 *dsp, unsigned int len) ...@@ -522,10 +534,6 @@ static int check_dsp(u8 *dsp, unsigned int len)
u32 pageoffset; u32 pageoffset;
unsigned int i, j, p, pp; unsigned int i, j, p, pp;
/* enough space for pagecount? */
if (len < 1)
return 1;
pagecount = FW_GET_BYTE(dsp); pagecount = FW_GET_BYTE(dsp);
p = 1; p = 1;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment