korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-17 01:04:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

iwlagn: fix firmware loading TLV error path

Browse Source 
gcc complains about the firmware loading:

iwl-agn.c: In function ‘iwlagn_load_firmware’:
iwl-agn.c:1860: warning: ‘tlv_len’ may be used uninitialized in this function
iwl-agn.c:1861: warning: ‘tlv_type’ may be used uninitialized in this function
iwl-agn.c:1862: warning: ‘tlv_data’ may be used uninitialized in this function

This is almost correct but we do do break out of the TLV
parsing loop when setting ret. However, the code is hard
to follow, and clearly even the compiler is having issues
with it too.

Additionally, however, the current code is wrong. If there
is a TLV length check error, the code will report
	invalid TLV after parsing: ...
because "len" will still be non-zero as we broke out of
the loop.

So to remove the warning and fix that issue, make the code
easier to read by doing length checking with an error label.
As a result, we can completely remove the "ret" variable.

Also, while at it, remove the "fixed_tlv_size" variable
since each TLV type has its own specified length, it just
happens that we have only variable length, flags (0 length)
and u32 TLVs right now. It should still be checked with more
explicit length checks to make it easier to understand.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
This commit is contained in:
Johannes Berg 2010-07-14 09:34:50 -07:00 committed by Wey-Yi Guy
parent 6a822d060c
commit 704da534af
1 changed files with 35 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
drivers/net/wireless/iwlwifi/iwl-agn.c
View File

@ -1828,7 +1828,6 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
u32 tlv_len; u32 tlv_len;
enum iwl_ucode_tlv_type tlv_type; enum iwl_ucode_tlv_type tlv_type;
const u8 *tlv_data; const u8 *tlv_data;
int ret = 0;
if (len < sizeof(*ucode)) { if (len < sizeof(*ucode)) {
IWL_ERR(priv, "uCode has invalid length: %zd\n", len); IWL_ERR(priv, "uCode has invalid length: %zd\n", len);
@ -1864,9 +1863,8 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
len -= sizeof(*ucode); len -= sizeof(*ucode);
while (len >= sizeof(*tlv) && !ret) { while (len >= sizeof(*tlv)) {
u16 tlv_alt; u16 tlv_alt;
u32 fixed_tlv_size = 4;
len -= sizeof(*tlv); len -= sizeof(*tlv);
tlv = (void *)data; tlv = (void *)data;
@ -1914,65 +1912,56 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
pieces->boot_size = tlv_len; pieces->boot_size = tlv_len;
break; break;
case IWL_UCODE_TLV_PROBE_MAX_LEN: case IWL_UCODE_TLV_PROBE_MAX_LEN:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else capa->max_probe_length =
capa->max_probe_length =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_EVTLOG_PTR: case IWL_UCODE_TLV_INIT_EVTLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_evtlog_ptr =
pieces->init_evtlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_EVTLOG_SIZE: case IWL_UCODE_TLV_INIT_EVTLOG_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_evtlog_size =
pieces->init_evtlog_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_INIT_ERRLOG_PTR: case IWL_UCODE_TLV_INIT_ERRLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->init_errlog_ptr =
pieces->init_errlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_EVTLOG_PTR: case IWL_UCODE_TLV_RUNT_EVTLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_evtlog_ptr =
pieces->inst_evtlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_EVTLOG_SIZE: case IWL_UCODE_TLV_RUNT_EVTLOG_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_evtlog_size =
pieces->inst_evtlog_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_RUNT_ERRLOG_PTR: case IWL_UCODE_TLV_RUNT_ERRLOG_PTR:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else pieces->inst_errlog_ptr =
pieces->inst_errlog_ptr =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
case IWL_UCODE_TLV_ENHANCE_SENS_TBL: case IWL_UCODE_TLV_ENHANCE_SENS_TBL:
if (tlv_len) if (tlv_len)
ret = -EINVAL; goto invalid_tlv_len;
else priv->enhance_sensitivity_table = true;
priv->enhance_sensitivity_table = true;
break; break;
case IWL_UCODE_TLV_PHY_CALIBRATION_SIZE: case IWL_UCODE_TLV_PHY_CALIBRATION_SIZE:
if (tlv_len != fixed_tlv_size) if (tlv_len != sizeof(u32))
ret = -EINVAL; goto invalid_tlv_len;
else capa->standard_phy_calibration_size =
capa->standard_phy_calibration_size =
le32_to_cpup((__le32 *)tlv_data); le32_to_cpup((__le32 *)tlv_data);
break; break;
default: default:
@ -1984,14 +1973,16 @@ static int iwlagn_load_firmware(struct iwl_priv *priv,
if (len) { if (len) {
IWL_ERR(priv, "invalid TLV after parsing: %zd\n", len); IWL_ERR(priv, "invalid TLV after parsing: %zd\n", len);
iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)data, len); iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)data, len);
ret = -EINVAL; return -EINVAL;
} else if (ret) {
IWL_ERR(priv, "TLV %d has invalid size: %u\n",
tlv_type, tlv_len);
iwl_print_hex_dump(priv, IWL_DL_FW, (u8 *)tlv_data, tlv_len);
} }
return ret; return 0;
invalid_tlv_len:
IWL_ERR(priv, "TLV %d has invalid size: %u\n", tlv_type, tlv_len);
iwl_print_hex_dump(priv, IWL_DL_FW, tlv_data, tlv_len);
return -EINVAL;
} }
/** /**