| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20071011.194543.75428024.davem@davemloft.net>
Date: Thu, 11 Oct 2007 19:45:43 -0700 (PDT)
From: David Miller <davem@...emloft.net>
To: akpm@...ux-foundation.org
Cc: netdev@...r.kernel.org, sam@...nborg.org, paulus@...ba.org,
benh@...nel.crashing.org, vda.linux@...glemail.com
Subject: Re: net-2.6.24 breaks powerpc mysteriously
From: Andrew Morton <akpm@...ux-foundation.org>
Date: Thu, 11 Oct 2007 19:22:33 -0700
> With net-2.6.24 (pulled yesterday) applied:
>
> g5:/usr/src/25> ml arch/powerpc/boot/inflate.o
> Using ARCH=powerpc CROSS_COMPILE=
> CHK include/linux/version.h
> CHK include/linux/utsrelease.h
> CALL scripts/checksyscalls.sh
> BOOTCC arch/powerpc/boot/inflate.o
> arch/powerpc/boot/inflate.c:920:19: errno.h: No such file or directory
> arch/powerpc/boot/inflate.c:921:18: slab.h: No such file or directory
> arch/powerpc/boot/inflate.c:922:21: vmalloc.h: No such file or directory
> arch/powerpc/boot/inflate.c: In function `zlib_inflate_blob':
> arch/powerpc/boot/inflate.c:928: error: syntax error before '*' token
The only thing we touched in zlib is in the patch below.
I suspect the lib/zlib_inflate/inflate.c changes, I had no idea that
some pieces of code try to use this into userspace.
I supposed a hacky fix is to add __KERNEL__ ifdef protection around
zlib_inflate_blob() and those troublesome includes. A nicer fix is
probably to change the zlib_inflate_blob() interface to pass in
pointers to alloc() and free() routines instead of calling kernel ones
directly.
Denys?
commit 8336793baf962163c9fab5a3f39614295fdbab27
Author: Denys Vlasenko <vda.linux@...glemail.com>
Date: Sun Sep 30 17:56:49 2007 -0700
[ZLIB]: Move bnx2 driver gzip unpacker into zlib.
Signed-off-by: Denys Vlasenko <vda.linux@...glemail.com>
Acked-by: Michael Chan <mchan@...adcom.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 73d4a57..6d6ea56 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -2761,48 +2761,6 @@ bnx2_set_rx_mode(struct net_device *dev)
spin_unlock_bh(&bp->phy_lock);
}
-/* To be moved to generic lib/ */
-static int
-bnx2_gunzip(void *gunzip_buf, unsigned sz, u8 *zbuf, int len)
-{
- struct z_stream_s *strm;
- int rc;
-
- /* gzip header (1f,8b,08... 10 bytes total + possible asciz filename)
- * is stripped */
-
- rc = -ENOMEM;
- strm = kmalloc(sizeof(*strm), GFP_KERNEL);
- if (strm == NULL)
- goto gunzip_nomem2;
- strm->workspace = kmalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
- if (strm->workspace == NULL)
- goto gunzip_nomem3;
-
- strm->next_in = zbuf;
- strm->avail_in = len;
- strm->next_out = gunzip_buf;
- strm->avail_out = sz;
-
- rc = zlib_inflateInit2(strm, -MAX_WBITS);
- if (rc == Z_OK) {
- rc = zlib_inflate(strm, Z_FINISH);
- /* after Z_FINISH, only Z_STREAM_END is "we unpacked it all" */
- if (rc == Z_STREAM_END)
- rc = sz - strm->avail_out;
- else
- rc = -EINVAL;
- zlib_inflateEnd(strm);
- } else
- rc = -EINVAL;
-
- kfree(strm->workspace);
-gunzip_nomem3:
- kfree(strm);
-gunzip_nomem2:
- return rc;
-}
-
static void
load_rv2p_fw(struct bnx2 *bp, u32 *rv2p_code, u32 rv2p_code_len,
u32 rv2p_proc)
@@ -2858,7 +2816,7 @@ load_cpu_fw(struct bnx2 *bp, struct cpu_reg *cpu_reg, struct fw_info *fw)
text = vmalloc(FW_BUF_SIZE);
if (!text)
return -ENOMEM;
- rc = bnx2_gunzip(text, FW_BUF_SIZE, fw->gz_text, fw->gz_text_len);
+ rc = zlib_inflate_blob(text, FW_BUF_SIZE, fw->gz_text, fw->gz_text_len);
if (rc < 0) {
vfree(text);
return rc;
@@ -2935,14 +2893,14 @@ bnx2_init_cpus(struct bnx2 *bp)
text = vmalloc(FW_BUF_SIZE);
if (!text)
return -ENOMEM;
- rc = bnx2_gunzip(text, FW_BUF_SIZE, bnx2_rv2p_proc1, sizeof(bnx2_rv2p_proc1));
+ rc = zlib_inflate_blob(text, FW_BUF_SIZE, bnx2_rv2p_proc1, sizeof(bnx2_rv2p_proc1));
if (rc < 0) {
vfree(text);
goto init_cpu_err;
}
load_rv2p_fw(bp, text, rc /* == len */, RV2P_PROC1);
- rc = bnx2_gunzip(text, FW_BUF_SIZE, bnx2_rv2p_proc2, sizeof(bnx2_rv2p_proc2));
+ rc = zlib_inflate_blob(text, FW_BUF_SIZE, bnx2_rv2p_proc2, sizeof(bnx2_rv2p_proc2));
if (rc < 0) {
vfree(text);
goto init_cpu_err;
diff --git a/include/linux/zlib.h b/include/linux/zlib.h
index 9e3192a..40c49cb 100644
--- a/include/linux/zlib.h
+++ b/include/linux/zlib.h
@@ -82,7 +82,7 @@
struct internal_state;
typedef struct z_stream_s {
- Byte *next_in; /* next input byte */
+ const Byte *next_in; /* next input byte */
uInt avail_in; /* number of bytes available at next_in */
uLong total_in; /* total nb of input bytes read so far */
@@ -699,4 +699,8 @@ extern int zlib_inflateInit2(z_streamp strm, int windowBits);
struct internal_state {int dummy;}; /* hack for buggy compilers */
#endif
+/* Utility function: initialize zlib, unpack binary blob, clean up zlib,
+ * return len or negative error code. */
+extern int zlib_inflate_blob(void *dst, unsigned dst_sz, const void *src, unsigned src_sz);
+
#endif /* _ZLIB_H */
diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c
index d84560c..8550b0c 100644
--- a/lib/zlib_inflate/inffast.c
+++ b/lib/zlib_inflate/inffast.c
@@ -69,22 +69,22 @@
void inflate_fast(z_streamp strm, unsigned start)
{
struct inflate_state *state;
- unsigned char *in; /* local strm->next_in */
- unsigned char *last; /* while in < last, enough input available */
- unsigned char *out; /* local strm->next_out */
- unsigned char *beg; /* inflate()'s initial strm->next_out */
- unsigned char *end; /* while out < end, enough space available */
+ const unsigned char *in; /* local strm->next_in */
+ const unsigned char *last; /* while in < last, enough input available */
+ unsigned char *out; /* local strm->next_out */
+ unsigned char *beg; /* inflate()'s initial strm->next_out */
+ unsigned char *end; /* while out < end, enough space available */
#ifdef INFLATE_STRICT
unsigned dmax; /* maximum distance from zlib header */
#endif
unsigned wsize; /* window size or zero if not using window */
unsigned whave; /* valid bytes in the window */
unsigned write; /* window write index */
- unsigned char *window; /* allocated sliding window, if wsize != 0 */
+ unsigned char *window; /* allocated sliding window, if wsize != 0 */
unsigned long hold; /* local strm->hold */
unsigned bits; /* local strm->bits */
- code const *lcode; /* local strm->lencode */
- code const *dcode; /* local strm->distcode */
+ code const *lcode; /* local strm->lencode */
+ code const *dcode; /* local strm->distcode */
unsigned lmask; /* mask for first level of length codes */
unsigned dmask; /* mask for first level of distance codes */
code this; /* retrieved table entry */
@@ -92,7 +92,7 @@ void inflate_fast(z_streamp strm, unsigned start)
/* window position, window bytes to copy */
unsigned len; /* match length, unused bytes */
unsigned dist; /* match distance */
- unsigned char *from; /* where to copy match from */
+ unsigned char *from; /* where to copy match from */
/* copy state to local variables */
state = (struct inflate_state *)strm->state;
diff --git a/lib/zlib_inflate/inflate.c b/lib/zlib_inflate/inflate.c
index 7e1e311..0ad1ebf 100644
--- a/lib/zlib_inflate/inflate.c
+++ b/lib/zlib_inflate/inflate.c
@@ -332,14 +332,14 @@ static int zlib_inflateSyncPacket(z_streamp strm)
int zlib_inflate(z_streamp strm, int flush)
{
struct inflate_state *state;
- unsigned char *next; /* next input */
- unsigned char *put; /* next output */
+ const unsigned char *next; /* next input */
+ unsigned char *put; /* next output */
unsigned have, left; /* available input and output */
unsigned long hold; /* bit buffer */
unsigned bits; /* bits in bit buffer */
unsigned in, out; /* save starting available input and output */
unsigned copy; /* number of stored or match bytes to copy */
- unsigned char *from; /* where to copy match bytes from */
+ unsigned char *from; /* where to copy match bytes from */
code this; /* current decoding table entry */
code last; /* parent table entry */
unsigned len; /* length to copy for repeats, bits to drop */
@@ -897,7 +897,7 @@ int zlib_inflateIncomp(z_stream *z)
/* Setup some variables to allow misuse of updateWindow */
z->avail_out = 0;
- z->next_out = z->next_in + z->avail_in;
+ z->next_out = (unsigned char*)z->next_in + z->avail_in;
zlib_updatewindow(z, z->avail_in);
@@ -916,3 +916,50 @@ int zlib_inflateIncomp(z_stream *z)
return Z_OK;
}
+
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+
+/* Utility function: initialize zlib, unpack binary blob, clean up zlib,
+ * return len or negative error code. */
+int zlib_inflate_blob(void *gunzip_buf, unsigned sz, const void *buf, unsigned len)
+{
+ const u8 *zbuf = buf;
+ struct z_stream_s *strm;
+ int rc;
+
+ rc = -ENOMEM;
+ strm = kmalloc(sizeof(*strm), GFP_KERNEL);
+ if (strm == NULL)
+ goto gunzip_nomem1;
+ strm->workspace = kmalloc(zlib_inflate_workspacesize(), GFP_KERNEL);
+ if (strm->workspace == NULL)
+ goto gunzip_nomem2;
+
+ /* gzip header (1f,8b,08... 10 bytes total + possible asciz filename)
+ * expected to be stripped from input */
+
+ strm->next_in = zbuf;
+ strm->avail_in = len;
+ strm->next_out = gunzip_buf;
+ strm->avail_out = sz;
+
+ rc = zlib_inflateInit2(strm, -MAX_WBITS);
+ if (rc == Z_OK) {
+ rc = zlib_inflate(strm, Z_FINISH);
+ /* after Z_FINISH, only Z_STREAM_END is "we unpacked it all" */
+ if (rc == Z_STREAM_END)
+ rc = sz - strm->avail_out;
+ else
+ rc = -EINVAL;
+ zlib_inflateEnd(strm);
+ } else
+ rc = -EINVAL;
+
+ kfree(strm->workspace);
+gunzip_nomem2:
+ kfree(strm);
+gunzip_nomem1:
+ return rc; /* returns Z_OK (0) if successful */
+}
diff --git a/lib/zlib_inflate/inflate_syms.c b/lib/zlib_inflate/inflate_syms.c
index 2061d4f..67329fe 100644
--- a/lib/zlib_inflate/inflate_syms.c
+++ b/lib/zlib_inflate/inflate_syms.c
@@ -16,4 +16,5 @@ EXPORT_SYMBOL(zlib_inflateInit2);
EXPORT_SYMBOL(zlib_inflateEnd);
EXPORT_SYMBOL(zlib_inflateReset);
EXPORT_SYMBOL(zlib_inflateIncomp);
+EXPORT_SYMBOL(zlib_inflate_blob);
MODULE_LICENSE("GPL");
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists