linux-kernel - [PATCH 06/14] staging: r8188eu: always initialise efuse buffer with 0xff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat,  9 Jul 2022 19:09:52 +0200
From:   Martin Kaiser <martin@...ser.cx>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Larry Finger <Larry.Finger@...inger.net>,
        Phillip Potter <phil@...lpotter.co.uk>,
        Michael Straube <straube.linux@...il.com>,
        Pavel Skripkin <paskripkin@...il.com>,
        linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org,
        Martin Kaiser <martin@...ser.cx>
Subject: [PATCH 06/14] staging: r8188eu: always initialise efuse buffer with 0xff

If BOOT_FROM_EEPROM is set, efuse_buf is not initialised before it is
passed to functions that read from it.

The buffer will be filled with 0x00 in this case like all local variables.
However, the parsing functions expect the buffer to be filled with 0xFF if
reading eeprom/efuse data failed. Fill the buffer with 0xFF before we try
to read the data.

Please note that this problem existed before we started using a local
buffer. Adapter->eeprompriv->efuse_eeprom_data was allocated as a part of
struct adapter by a vzalloc call in rtw_usb_if1_init.

Signed-off-by: Martin Kaiser <martin@...ser.cx>
---
 drivers/staging/r8188eu/hal/usb_halinit.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c
index 807d8ce8cbfc..258ab963cf8a 100644
--- a/drivers/staging/r8188eu/hal/usb_halinit.c
+++ b/drivers/staging/r8188eu/hal/usb_halinit.c
@@ -940,14 +940,12 @@ void ReadAdapterInfo8188EU(struct adapter *Adapter)
 
 	eeprom->bautoload_fail_flag	= !(eeValue & EEPROM_EN);
 
-	if (!(eeValue & BOOT_FROM_EEPROM)) {
-		if (eeprom->bautoload_fail_flag) {
-			memset(efuse_buf, 0xFF, sizeof(efuse_buf));
-		} else {
-			rtl8188e_EfusePowerSwitch(Adapter, true);
-			rtl8188e_ReadEFuse(Adapter, 0, EFUSE_MAP_LEN_88E, efuse_buf);
-			rtl8188e_EfusePowerSwitch(Adapter, false);
-		}
+	memset(efuse_buf, 0xFF, sizeof(efuse_buf));
+
+	if (!(eeValue & BOOT_FROM_EEPROM) && !eeprom->bautoload_fail_flag) {
+		rtl8188e_EfusePowerSwitch(Adapter, true);
+		rtl8188e_ReadEFuse(Adapter, 0, EFUSE_MAP_LEN_88E, efuse_buf);
+		rtl8188e_EfusePowerSwitch(Adapter, false);
 	}
 
 	/* parse the eeprom/efuse content */
-- 
2.30.2