 876efcf05c
			
		
	
	
	876efcf05c
	
	
	
		
			
			On 64 bit systems we write past the end of the arg[] array.
Fixes: 8e84c25821 ('wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
		
	
			
		
			
				
	
	
		
			181 lines
		
	
	
	
		
			4.6 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			181 lines
		
	
	
	
		
			4.6 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * Copyright (c) 2013 Eugene Krasnikov <k.eugene.e@gmail.com>
 | |
|  *
 | |
|  * Permission to use, copy, modify, and/or distribute this software for any
 | |
|  * purpose with or without fee is hereby granted, provided that the above
 | |
|  * copyright notice and this permission notice appear in all copies.
 | |
|  *
 | |
|  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 | |
|  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 | |
|  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 | |
|  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 | |
|  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
 | |
|  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 | |
|  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 | |
|  */
 | |
| 
 | |
| #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 | |
| 
 | |
| #include <linux/debugfs.h>
 | |
| #include <linux/uaccess.h>
 | |
| #include "wcn36xx.h"
 | |
| #include "debug.h"
 | |
| #include "pmc.h"
 | |
| 
 | |
| #ifdef CONFIG_WCN36XX_DEBUGFS
 | |
| 
 | |
| static ssize_t read_file_bool_bmps(struct file *file, char __user *user_buf,
 | |
| 				   size_t count, loff_t *ppos)
 | |
| {
 | |
| 	struct wcn36xx *wcn = file->private_data;
 | |
| 	struct wcn36xx_vif *vif_priv = NULL;
 | |
| 	struct ieee80211_vif *vif = NULL;
 | |
| 	char buf[3];
 | |
| 
 | |
| 	list_for_each_entry(vif_priv, &wcn->vif_list, list) {
 | |
| 			vif = container_of((void *)vif_priv,
 | |
| 				   struct ieee80211_vif,
 | |
| 				   drv_priv);
 | |
| 			if (NL80211_IFTYPE_STATION == vif->type) {
 | |
| 				if (vif_priv->pw_state == WCN36XX_BMPS)
 | |
| 					buf[0] = '1';
 | |
| 				else
 | |
| 					buf[0] = '0';
 | |
| 				break;
 | |
| 			}
 | |
| 	}
 | |
| 	buf[1] = '\n';
 | |
| 	buf[2] = 0x00;
 | |
| 
 | |
| 	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 | |
| }
 | |
| 
 | |
| static ssize_t write_file_bool_bmps(struct file *file,
 | |
| 				    const char __user *user_buf,
 | |
| 				    size_t count, loff_t *ppos)
 | |
| {
 | |
| 	struct wcn36xx *wcn = file->private_data;
 | |
| 	struct wcn36xx_vif *vif_priv = NULL;
 | |
| 	struct ieee80211_vif *vif = NULL;
 | |
| 
 | |
| 	char buf[32];
 | |
| 	int buf_size;
 | |
| 
 | |
| 	buf_size = min(count, (sizeof(buf)-1));
 | |
| 	if (copy_from_user(buf, user_buf, buf_size))
 | |
| 		return -EFAULT;
 | |
| 
 | |
| 	switch (buf[0]) {
 | |
| 	case 'y':
 | |
| 	case 'Y':
 | |
| 	case '1':
 | |
| 		list_for_each_entry(vif_priv, &wcn->vif_list, list) {
 | |
| 			vif = container_of((void *)vif_priv,
 | |
| 				   struct ieee80211_vif,
 | |
| 				   drv_priv);
 | |
| 			if (NL80211_IFTYPE_STATION == vif->type) {
 | |
| 				wcn36xx_enable_keep_alive_null_packet(wcn, vif);
 | |
| 				wcn36xx_pmc_enter_bmps_state(wcn, vif);
 | |
| 			}
 | |
| 		}
 | |
| 		break;
 | |
| 	case 'n':
 | |
| 	case 'N':
 | |
| 	case '0':
 | |
| 		list_for_each_entry(vif_priv, &wcn->vif_list, list) {
 | |
| 			vif = container_of((void *)vif_priv,
 | |
| 				   struct ieee80211_vif,
 | |
| 				   drv_priv);
 | |
| 			if (NL80211_IFTYPE_STATION == vif->type)
 | |
| 				wcn36xx_pmc_exit_bmps_state(wcn, vif);
 | |
| 		}
 | |
| 		break;
 | |
| 	}
 | |
| 
 | |
| 	return count;
 | |
| }
 | |
| 
 | |
| static const struct file_operations fops_wcn36xx_bmps = {
 | |
| 	.open = simple_open,
 | |
| 	.read  =       read_file_bool_bmps,
 | |
| 	.write =       write_file_bool_bmps,
 | |
| };
 | |
| 
 | |
| static ssize_t write_file_dump(struct file *file,
 | |
| 				    const char __user *user_buf,
 | |
| 				    size_t count, loff_t *ppos)
 | |
| {
 | |
| 	struct wcn36xx *wcn = file->private_data;
 | |
| 	char buf[255], *tmp;
 | |
| 	int buf_size;
 | |
| 	u32 arg[WCN36xx_MAX_DUMP_ARGS];
 | |
| 	int i;
 | |
| 
 | |
| 	memset(buf, 0, sizeof(buf));
 | |
| 	memset(arg, 0, sizeof(arg));
 | |
| 
 | |
| 	buf_size = min(count, (sizeof(buf) - 1));
 | |
| 	if (copy_from_user(buf, user_buf, buf_size))
 | |
| 		return -EFAULT;
 | |
| 
 | |
| 	tmp = buf;
 | |
| 
 | |
| 	for (i = 0; i < WCN36xx_MAX_DUMP_ARGS; i++) {
 | |
| 		char *begin;
 | |
| 		begin = strsep(&tmp, " ");
 | |
| 		if (begin == NULL)
 | |
| 			break;
 | |
| 
 | |
| 		if (kstrtou32(begin, 0, &arg[i]) != 0)
 | |
| 			break;
 | |
| 	}
 | |
| 
 | |
| 	wcn36xx_info("DUMP args is %d %d %d %d %d\n", arg[0], arg[1], arg[2],
 | |
| 		     arg[3], arg[4]);
 | |
| 	wcn36xx_smd_dump_cmd_req(wcn, arg[0], arg[1], arg[2], arg[3], arg[4]);
 | |
| 
 | |
| 	return count;
 | |
| }
 | |
| 
 | |
| static const struct file_operations fops_wcn36xx_dump = {
 | |
| 	.open = simple_open,
 | |
| 	.write =       write_file_dump,
 | |
| };
 | |
| 
 | |
| #define ADD_FILE(name, mode, fop, priv_data)		\
 | |
| 	do {							\
 | |
| 		struct dentry *d;				\
 | |
| 		d = debugfs_create_file(__stringify(name),	\
 | |
| 					mode, dfs->rootdir,	\
 | |
| 					priv_data, fop);	\
 | |
| 		dfs->file_##name.dentry = d;			\
 | |
| 		if (IS_ERR(d)) {				\
 | |
| 			wcn36xx_warn("Create the debugfs entry failed");\
 | |
| 			dfs->file_##name.dentry = NULL;		\
 | |
| 		}						\
 | |
| 	} while (0)
 | |
| 
 | |
| 
 | |
| void wcn36xx_debugfs_init(struct wcn36xx *wcn)
 | |
| {
 | |
| 	struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
 | |
| 
 | |
| 	dfs->rootdir = debugfs_create_dir(KBUILD_MODNAME,
 | |
| 					  wcn->hw->wiphy->debugfsdir);
 | |
| 	if (IS_ERR(dfs->rootdir)) {
 | |
| 		wcn36xx_warn("Create the debugfs failed\n");
 | |
| 		dfs->rootdir = NULL;
 | |
| 	}
 | |
| 
 | |
| 	ADD_FILE(bmps_switcher, S_IRUSR | S_IWUSR,
 | |
| 		 &fops_wcn36xx_bmps, wcn);
 | |
| 	ADD_FILE(dump, S_IWUSR, &fops_wcn36xx_dump, wcn);
 | |
| }
 | |
| 
 | |
| void wcn36xx_debugfs_exit(struct wcn36xx *wcn)
 | |
| {
 | |
| 	struct wcn36xx_dfs_entry *dfs = &wcn->dfs;
 | |
| 	debugfs_remove_recursive(dfs->rootdir);
 | |
| }
 | |
| 
 | |
| #endif /* CONFIG_WCN36XX_DEBUGFS */
 |