netdev - [PATCH RESENT] staging: r8188eu: Move writeN buffer off stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5261AA78.6090205@lwfinger.net>
Date:	Fri, 18 Oct 2013 16:39:04 -0500
From:	Larry Finger <Larry.Finger@...inger.net>
To:	gregkh@...uxfoundation.org
CC:	netdev <netdev@...r.kernel.org>,
	Larry Finger <Larry.Finger@...inger.net>,
	devel@...verdev.osuosl.org
Subject: [PATCH RESENT] staging: r8188eu: Move writeN buffer off stack

The driver places a 254-byte buffer on the stack when writing long output.
To reduce stack usage, a buffer of the required length is acquired using
kmemdup().

Signed-off-by: Larry Finger <Larry.Finger@...inger.net>
---
  drivers/staging/rtl8188eu/hal/usb_ops_linux.c | 58 +++++++++++++++++++--------
  1 file changed, 42 insertions(+), 16 deletions(-)

diff --git a/drivers/staging/rtl8188eu/hal/usb_ops_linux.c 
b/drivers/staging/rtl8188eu/hal/usb_ops_linux.c
index 787763e..7ba52a1 100644
--- a/drivers/staging/rtl8188eu/hal/usb_ops_linux.c
+++ b/drivers/staging/rtl8188eu/hal/usb_ops_linux.c
@@ -267,28 +267,54 @@ static int usb_write32(struct intf_hdl *pintfhdl, u32 
addr, u32 val)
   static int usb_writeN(struct intf_hdl *pintfhdl, u32 addr, u32 length, u8 *pdata)
  {
-	u8 request;
-	u8 requesttype;
-	u16 wvalue;
-	u16 index;
-	u16 len;
-	u8 buf[VENDOR_CMD_MAX_DATA_LEN] = {0};
+	struct adapter	*adapt = pintfhdl->padapter;
+	struct dvobj_priv  *dvobjpriv = adapter_to_dvobj(adapt);
+	struct usb_device *udev = dvobjpriv->pusbdev;
+	u8 request = REALTEK_USB_VENQT_CMD_REQ;
+	u8 reqtype =  REALTEK_USB_VENQT_WRITE;
+	u16 value = (u16)(addr & 0x0000ffff);
+	u16 index = REALTEK_USB_VENQT_CMD_IDX;
+	int pipe = usb_sndctrlpipe(udev, 0); /* write_out */
+	u8 *buffer;
  	int ret;
+	int vendorreq_times = 0;
  -	_func_enter_;
-
-	request = 0x05;
-	requesttype = 0x00;/* write_out */
-	index = 0;/* n/a */
+	buffer = kmemdup(pdata, length, GFP_ATOMIC);
+	if (!buffer)
+		return -ENOMEM;
+	while (++vendorreq_times <= MAX_USBCTRL_VENDORREQ_TIMES) {
+		pipe = usb_sndctrlpipe(udev, 0);/* write_out */
  -	wvalue = (u16)(addr&0x0000ffff);
-	len = length;
-	 memcpy(buf, pdata, len);
+		ret = rtw_usb_control_msg(udev, pipe, request, reqtype,
+					  value, index, buffer, length,
+					  RTW_USB_CONTROL_MSG_TIMEOUT);
  -	ret = usbctrl_vendorreq(pintfhdl, request, wvalue, index, buf, len, 
requesttype);
+		if (ret == length) {   /*  Success this control transfer. */
+			rtw_reset_continual_urb_error(dvobjpriv);
+		} else { /*  error cases */
+			DBG_88E("reg 0x%x, usb %u write fail, status:%d value=0x%x, 
vendorreq_times:%d\n",
+				value, length, ret, *(u32 *)pdata, vendorreq_times);
  -	_func_exit_;
+			if (ret < 0) {
+				if (ret == (-ESHUTDOWN) || ret == -ENODEV) {
+					adapt->bSurpriseRemoved = true;
+				} else {
+					struct hal_data_8188e	*haldata = GET_HAL_DATA(adapt);
+					haldata->srestpriv.Wifi_Error_Status = USB_VEN_REQ_CMD_FAIL;
+				}
+			}
+			if (rtw_inc_and_chk_continual_urb_error(dvobjpriv)) {
+				adapt->bSurpriseRemoved = true;
+				break;
+			}
+		}
  +		/*  firmware download is checksumed, don't retry */
+		if ((value >= FW_8188E_START_ADDRESS &&
+		    value <= FW_8188E_END_ADDRESS) || ret == length)
+			break;
+	}
+	kfree(buffer);
  	return ret;
  }
  -- 1.8.4


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html