Commit 704da534 authored by Johannes Berg's avatar Johannes Berg Committed by Wey-Yi Guy

iwlagn: fix firmware loading TLV error path

gcc complains about the firmware loading:

iwl-agn.c: In function ‘iwlagn_load_firmware’:
iwl-agn.c:1860: warning: ‘tlv_len’ may be used uninitialized in this function
iwl-agn.c:1861: warning: ‘tlv_type’ may be used uninitialized in this function
iwl-agn.c:1862: warning: ‘tlv_data’ may be used uninitialized in this function

This is almost correct but we do do break out of the TLV
parsing loop when setting ret. However, the code is hard
to follow, and clearly even the compiler is having issues
with it too.

Additionally, however, the current code is wrong. If there
is a TLV length check error, the code will report
	invalid TLV after parsing: ...
because "len" will still be non-zero as we broke out of
the loop.

So to remove the warning and fix that issue, make the code
easier to read by doing length checking with an error label.
As a result, we can completely remove the "ret" variable.

Also, while at it, remove the "fixed_tlv_size" variable
since each TLV type has its own specified length, it just
happens that we have only variable length, flags (0 length)
and u32 TLVs right now. It should still be checked with more
explicit length checks to make it easier to understand.
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarWey-Yi Guy <wey-yi.w.guy@intel.com>
parent 6a822d06
...@@ -1828,7 +1828,6 @@ static int iwlagn_load_firmware(struct iwl_priv *priv, ...@@ -1828,7 +1828,6 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
u32 tlv_len; u32 tlv_len;
enum iwl_ucode_tlv_type tlv_type; enum iwl_ucode_tlv_type tlv_type;
const u8 *tlv_data; const u8 *tlv_data;
int ret = 0;
if (len < sizeof(*ucode)) { if (len < sizeof(*ucode)) {
IWL_ERR(priv, "uCode has invalid length: %zd\n", len); IWL_ERR(priv, "uCode has invalid length: %zd\n", len);
...@@ -1864,9 +1863,8 @@ static int iwlagn_load_firmware(struct iwl_priv *priv, ...@@ -1864,9 +1863,8 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
len -= sizeof(*ucode); len -= sizeof(*ucode);
while (len >= sizeof(*tlv) && !ret) { while (len >= sizeof(*tlv)) {
u16 tlv_alt; u16 tlv_alt;
u32 fixed_tlv_size = 4;
len -= sizeof(*tlv); len -= sizeof(*tlv);
tlv = (void *)data; tlv = (void *)data;
...@@ -1914,65 +1912,56 @@ static int iwlagn_load_firmware(struct iwl_priv *priv, ...@@ -1914,65 +1912,56 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
pieces->boot_size = tlv_len; pieces->boot_size = tlv_len;
break; break;
case IWL_UCODE_TLV_PROBE_MAX_LEN: case IWL_UCODE_TLV_PROBE_MAX_LEN:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else capa->max_probe_length =
capa->max_probe_length =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_EVTLOG_PTR: case IWL_UCODE_TLV_INIT_EVTLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_evtlog_ptr =
pieces->init_evtlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_EVTLOG_SIZE: case IWL_UCODE_TLV_INIT_EVTLOG_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_evtlog_size =
pieces->init_evtlog_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_ERRLOG_PTR: case IWL_UCODE_TLV_INIT_ERRLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_errlog_ptr =
pieces->init_errlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_EVTLOG_PTR: case IWL_UCODE_TLV_RUNT_EVTLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_evtlog_ptr =
pieces->inst_evtlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_EVTLOG_SIZE: case IWL_UCODE_TLV_RUNT_EVTLOG_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_evtlog_size =
pieces->inst_evtlog_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_ERRLOG_PTR: case IWL_UCODE_TLV_RUNT_ERRLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_errlog_ptr =
pieces->inst_errlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_ENHANCE_SENS_TBL: case IWL_UCODE_TLV_ENHANCE_SENS_TBL:
if (tlv_len) if (tlv_len)
ret = -EINVAL; goto invalid_tlv_len;
else priv->enhance_sensitivity_table = true;
priv->enhance_sensitivity_table = true;
break; break;
case IWL_UCODE_TLV_PHY_CALIBRATION_SIZE: case IWL_UCODE_TLV_PHY_CALIBRATION_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else capa->standard_phy_calibration_size =
capa->standard_phy_calibration_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
default: default:
...@@ -1984,14 +1973,16 @@ static int iwlagn_load_firmware(struct iwl_priv *priv, ...@@ -1984,14 +1973,16 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
if (len) { if (len) {
IWL_ERR(priv, "invalid TLV after parsing: %zd\n", len); IWL_ERR(priv, "invalid TLV after parsing: %zd\n", len);
iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)data, len); iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)data, len);
ret = -EINVAL; return -EINVAL;
} else if (ret) {
IWL_ERR(priv, "TLV %d has invalid size: %u\n",
tlv_type, tlv_len);
iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)tlv_data, tlv_len);
} }
return ret; return 0;
invalid_tlv_len:
IWL_ERR(priv, "TLV %d has invalid size: %u\n", tlv_type, tlv_len);
iwl_print_hex_dump(priv, IWL_DL_FW, tlv_data, tlv_len);
return -EINVAL;
} }
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment