| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 15 Mar 2021 10:21:11 -0500
From: Alex Elder <elder@...aro.org>
To: davem@...emloft.net, kuba@...nel.org
Cc: manivannan.sadhasivam@...aro.org, bjorn.andersson@...aro.org,
evgreen@...omium.org, cpratapa@...eaurora.org, elder@...nel.org,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH net-next 2/3] net: ipa: fix another QMI message definition
The ipa_init_modem_driver_req_ei[] encoding array for the
INIT_MODEM_DRIVER request message has some errors in it.
First, the tlv_type associated with the hw_stats_quota_size field is
wrong; it duplicates the valiue used for the hw_stats_quota_base_addr
field (0x1f) and should use 0x20 instead. The tlv_type value for
the hw_stats_drop_size field also uses the same duplicate value; it
should use 0x22 instead.
Second, there is no definition for the hw_stats_drop_base_addr
field. It is an optional 32-bit enumerated type value.
Finally, the hw_stats_quota_base_addr, hw_stats_quota_size, and
hw_stats_drop_size fields are defined as enumerated types; they
should be unsigned 4-byte values.
Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Signed-off-by: Alex Elder <elder@...aro.org>
---
drivers/net/ipa/ipa_qmi_msg.c | 34 +++++++++++++++++++++++++++-------
1 file changed, 27 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ipa/ipa_qmi_msg.c b/drivers/net/ipa/ipa_qmi_msg.c
index e00f829a783f6..e4a6efbe9bd00 100644
--- a/drivers/net/ipa/ipa_qmi_msg.c
+++ b/drivers/net/ipa/ipa_qmi_msg.c
@@ -530,7 +530,7 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = {
hw_stats_quota_base_addr_valid),
},
{
- .data_type = QMI_SIGNED_4_BYTE_ENUM,
+ .data_type = QMI_UNSIGNED_4_BYTE,
.elem_len = 1,
.elem_size =
sizeof_field(struct ipa_init_modem_driver_req,
@@ -545,37 +545,57 @@ struct qmi_elem_info ipa_init_modem_driver_req_ei[] = {
.elem_size =
sizeof_field(struct ipa_init_modem_driver_req,
hw_stats_quota_size_valid),
- .tlv_type = 0x1f,
+ .tlv_type = 0x20,
.offset = offsetof(struct ipa_init_modem_driver_req,
hw_stats_quota_size_valid),
},
{
- .data_type = QMI_SIGNED_4_BYTE_ENUM,
+ .data_type = QMI_UNSIGNED_4_BYTE,
.elem_len = 1,
.elem_size =
sizeof_field(struct ipa_init_modem_driver_req,
hw_stats_quota_size),
- .tlv_type = 0x1f,
+ .tlv_type = 0x20,
.offset = offsetof(struct ipa_init_modem_driver_req,
hw_stats_quota_size),
},
+ {
+ .data_type = QMI_OPT_FLAG,
+ .elem_len = 1,
+ .elem_size =
+ sizeof_field(struct ipa_init_modem_driver_req,
+ hw_stats_drop_base_addr_valid),
+ .tlv_type = 0x21,
+ .offset = offsetof(struct ipa_init_modem_driver_req,
+ hw_stats_drop_base_addr_valid),
+ },
+ {
+ .data_type = QMI_UNSIGNED_4_BYTE,
+ .elem_len = 1,
+ .elem_size =
+ sizeof_field(struct ipa_init_modem_driver_req,
+ hw_stats_drop_base_addr),
+ .tlv_type = 0x21,
+ .offset = offsetof(struct ipa_init_modem_driver_req,
+ hw_stats_drop_base_addr),
+ },
{
.data_type = QMI_OPT_FLAG,
.elem_len = 1,
.elem_size =
sizeof_field(struct ipa_init_modem_driver_req,
hw_stats_drop_size_valid),
- .tlv_type = 0x1f,
+ .tlv_type = 0x22,
.offset = offsetof(struct ipa_init_modem_driver_req,
hw_stats_drop_size_valid),
},
{
- .data_type = QMI_SIGNED_4_BYTE_ENUM,
+ .data_type = QMI_UNSIGNED_4_BYTE,
.elem_len = 1,
.elem_size =
sizeof_field(struct ipa_init_modem_driver_req,
hw_stats_drop_size),
- .tlv_type = 0x1f,
+ .tlv_type = 0x22,
.offset = offsetof(struct ipa_init_modem_driver_req,
hw_stats_drop_size),
},
--
2.27.0
Powered by blists - more mailing lists