Commit 36f7e3ac authored by Jérôme Pouiller's avatar Jérôme Pouiller Committed by Greg Kroah-Hartman
Browse files

staging: wfx: ensure that received hif messages are never modified 



There are no real reason to modify the data received from device. So,
let's mark the arguments constant.

Signed-off-by: default avatarJérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20191217161318.31402-23-Jerome.Pouiller@silabs.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 30cfffb7

drivers/staging/wfx/data_rx.c

+5 −3
Original line number Diff line number Diff line
@@ -48,7 +48,9 @@ static int wfx_handle_pspoll(struct wfx_vif *wvif, struct sk_buff *skb) 
	return 0;

}



static int wfx_drop_encrypt_data(struct wfx_dev *wdev, struct hif_ind_rx *arg, struct sk_buff *skb)

static int wfx_drop_encrypt_data(struct wfx_dev *wdev,

				 const struct hif_ind_rx *arg,

				 struct sk_buff *skb)

{

	struct ieee80211_hdr *frame = (struct ieee80211_hdr *) skb->data;

	size_t hdrlen = ieee80211_hdrlen(frame->frame_control);
@@ -98,8 +100,8 @@ static int wfx_drop_encrypt_data(struct wfx_dev *wdev, struct hif_ind_rx *arg, s 


}



void wfx_rx_cb(struct wfx_vif *wvif, struct hif_ind_rx *arg,

	       struct sk_buff *skb)

void wfx_rx_cb(struct wfx_vif *wvif,

	       const struct hif_ind_rx *arg, struct sk_buff *skb)

{

	int link_id = arg->rx_flags.peer_sta_id;

	struct ieee80211_rx_status *hdr = IEEE80211_SKB_RXCB(skb);

drivers/staging/wfx/data_rx.h

+2 −2
Original line number Diff line number Diff line
@@ -13,7 +13,7 @@ 
struct wfx_vif;

struct sk_buff;



void wfx_rx_cb(struct wfx_vif *wvif, struct hif_ind_rx *arg,

	       struct sk_buff *skb);

void wfx_rx_cb(struct wfx_vif *wvif,

	       const struct hif_ind_rx *arg, struct sk_buff *skb);



#endif /* WFX_DATA_RX_H */

drivers/staging/wfx/data_tx.c

+1 −1
Original line number Diff line number Diff line
@@ -720,7 +720,7 @@ void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control, 
	ieee80211_tx_status_irqsafe(wdev->hw, skb);

}



void wfx_tx_confirm_cb(struct wfx_vif *wvif, struct hif_cnf_tx *arg)

void wfx_tx_confirm_cb(struct wfx_vif *wvif, const struct hif_cnf_tx *arg)

{

	int i;

	int tx_count;

drivers/staging/wfx/data_tx.h

+1 −1
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ void wfx_tx_policy_upload_work(struct work_struct *work); 


void wfx_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,

	    struct sk_buff *skb);

void wfx_tx_confirm_cb(struct wfx_vif *wvif, struct hif_cnf_tx *arg);

void wfx_tx_confirm_cb(struct wfx_vif *wvif, const struct hif_cnf_tx *arg);

void wfx_skb_dtor(struct wfx_dev *wdev, struct sk_buff *skb);



int wfx_unmap_link(struct wfx_vif *wvif, int link_id);

drivers/staging/wfx/hif_rx.c

+52 −42
Original line number Diff line number Diff line
@@ -18,8 +18,8 @@ 
#include "secure_link.h"

#include "hif_api_cmd.h"



static int hif_generic_confirm(struct wfx_dev *wdev, struct hif_msg *hif,

			       void *buf)

static int hif_generic_confirm(struct wfx_dev *wdev,

			       const struct hif_msg *hif, const void *buf)

{

	// All confirm messages start with status

	int status = le32_to_cpu(*((__le32 *) buf));
@@ -59,9 +59,10 @@ static int hif_generic_confirm(struct wfx_dev *wdev, struct hif_msg *hif, 
	return status;

}



static int hif_tx_confirm(struct wfx_dev *wdev, struct hif_msg *hif, void *buf)

static int hif_tx_confirm(struct wfx_dev *wdev,

			  const struct hif_msg *hif, const void *buf)

{

	struct hif_cnf_tx *body = buf;

	const struct hif_cnf_tx *body = buf;

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);



	WARN_ON(!wvif);
@@ -72,11 +73,12 @@ static int hif_tx_confirm(struct wfx_dev *wdev, struct hif_msg *hif, void *buf) 
	return 0;

}



static int hif_multi_tx_confirm(struct wfx_dev *wdev, struct hif_msg *hif,

				void *buf)

static int hif_multi_tx_confirm(struct wfx_dev *wdev,

				const struct hif_msg *hif, const void *buf)

{

	struct hif_cnf_multi_transmit *body = buf;

	struct hif_cnf_tx *buf_loc = (struct hif_cnf_tx *) &body->tx_conf_payload;

	const struct hif_cnf_multi_transmit *body = buf;

	const struct hif_cnf_tx *buf_loc =

		(const struct hif_cnf_tx *)&body->tx_conf_payload;

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);

	int count = body->num_tx_confs;

	int i;
@@ -93,10 +95,10 @@ static int hif_multi_tx_confirm(struct wfx_dev *wdev, struct hif_msg *hif, 
	return 0;

}



static int hif_startup_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				  void *buf)

static int hif_startup_indication(struct wfx_dev *wdev,

				  const struct hif_msg *hif, const void *buf)

{

	struct hif_ind_startup *body = buf;

	const struct hif_ind_startup *body = buf;



	if (body->status || body->firmware_type > 4) {

		dev_err(wdev->dev, "received invalid startup indication");
@@ -112,8 +114,8 @@ static int hif_startup_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
	return 0;

}



static int hif_wakeup_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				 void *buf)

static int hif_wakeup_indication(struct wfx_dev *wdev,

				 const struct hif_msg *hif, const void *buf)

{

	if (!wdev->pdata.gpio_wakeup

	    || !gpiod_get_value(wdev->pdata.gpio_wakeup)) {
@@ -123,25 +125,27 @@ static int hif_wakeup_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
	return 0;

}



static int hif_keys_indication(struct wfx_dev *wdev, struct hif_msg *hif,

			       void *buf)

static int hif_keys_indication(struct wfx_dev *wdev,

			       const struct hif_msg *hif, const void *buf)

{

	struct hif_ind_sl_exchange_pub_keys *body = buf;

	const struct hif_ind_sl_exchange_pub_keys *body = buf;

	u8 pubkey[API_NCP_PUB_KEY_SIZE];



	// Compatibility with legacy secure link

	if (body->status == SL_PUB_KEY_EXCHANGE_STATUS_SUCCESS)

		body->status = 0;

	if (body->status)

	// SL_PUB_KEY_EXCHANGE_STATUS_SUCCESS is used by legacy secure link

	if (body->status && body->status != SL_PUB_KEY_EXCHANGE_STATUS_SUCCESS)

		dev_warn(wdev->dev, "secure link negociation error\n");

	wfx_sl_check_pubkey(wdev, body->ncp_pub_key, body->ncp_pub_key_mac);

	memcpy(pubkey, body->ncp_pub_key, sizeof(pubkey));

	memreverse(pubkey, sizeof(pubkey));

	wfx_sl_check_pubkey(wdev, pubkey, body->ncp_pub_key_mac);

	return 0;

}



static int hif_receive_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				  void *buf, struct sk_buff *skb)

static int hif_receive_indication(struct wfx_dev *wdev,

				  const struct hif_msg *hif,

				  const void *buf, struct sk_buff *skb)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);

	struct hif_ind_rx *body = buf;

	const struct hif_ind_rx *body = buf;



	if (!wvif) {

		dev_warn(wdev->dev, "ignore rx data for non-existent vif %d\n",
@@ -154,11 +158,11 @@ static int hif_receive_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
	return 0;

}



static int hif_event_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				void *buf)

static int hif_event_indication(struct wfx_dev *wdev,

				const struct hif_msg *hif, const void *buf)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);

	struct hif_ind_event *body = buf;

	const struct hif_ind_event *body = buf;

	struct wfx_hif_event *event;

	int first;
@@ -183,7 +187,8 @@ static int hif_event_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
}



static int hif_pm_mode_complete_indication(struct wfx_dev *wdev,

					   struct hif_msg *hif, void *buf)

					   const struct hif_msg *hif,

					   const void *buf)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);
@@ -194,10 +199,11 @@ static int hif_pm_mode_complete_indication(struct wfx_dev *wdev, 
}



static int hif_scan_complete_indication(struct wfx_dev *wdev,

					struct hif_msg *hif, void *buf)

					const struct hif_msg *hif,

					const void *buf)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);

	struct hif_ind_scan_cmpl *body = buf;

	const struct hif_ind_scan_cmpl *body = buf;



	WARN_ON(!wvif);

	wfx_scan_complete_cb(wvif, body);
@@ -206,7 +212,8 @@ static int hif_scan_complete_indication(struct wfx_dev *wdev, 
}



static int hif_join_complete_indication(struct wfx_dev *wdev,

					struct hif_msg *hif, void *buf)

					const struct hif_msg *hif,

					const void *buf)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);
@@ -217,10 +224,11 @@ static int hif_join_complete_indication(struct wfx_dev *wdev, 
}



static int hif_suspend_resume_indication(struct wfx_dev *wdev,

					 struct hif_msg *hif, void *buf)

					 const struct hif_msg *hif,

					 const void *buf)

{

	struct wfx_vif *wvif = wdev_to_wvif(wdev, hif->interface);

	struct hif_ind_suspend_resume_tx *body = buf;

	const struct hif_ind_suspend_resume_tx *body = buf;



	WARN_ON(!wvif);

	wfx_suspend_resume(wvif, body);
@@ -228,10 +236,10 @@ static int hif_suspend_resume_indication(struct wfx_dev *wdev, 
	return 0;

}



static int hif_error_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				void *buf)

static int hif_error_indication(struct wfx_dev *wdev,

				const struct hif_msg *hif, const void *buf)

{

	struct hif_ind_error *body = buf;

	const struct hif_ind_error *body = buf;

	u8 *pRollback = (u8 *) body->data;

	u32 *pStatus = (u32 *) body->data;
@@ -268,10 +276,10 @@ static int hif_error_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
	return 0;

}



static int hif_generic_indication(struct wfx_dev *wdev, struct hif_msg *hif,

				  void *buf)

static int hif_generic_indication(struct wfx_dev *wdev,

				  const struct hif_msg *hif, const void *buf)

{

	struct hif_ind_generic *body = buf;

	const struct hif_ind_generic *body = buf;



	switch (body->indication_type) {

	case HIF_GENERIC_INDICATION_TYPE_RAW:
@@ -299,9 +307,10 @@ static int hif_generic_indication(struct wfx_dev *wdev, struct hif_msg *hif, 
}



static int hif_exception_indication(struct wfx_dev *wdev,

				    struct hif_msg *hif, void *buf)

				    const struct hif_msg *hif, const void *buf)

{

	size_t len = hif->len - 4; // drop header



	dev_err(wdev->dev, "firmware exception\n");

	print_hex_dump_bytes("Dump: ", DUMP_PREFIX_NONE, buf, len);

	wdev->chip_frozen = 1;
@@ -311,7 +320,8 @@ static int hif_exception_indication(struct wfx_dev *wdev, 


static const struct {

	int msg_id;

	int (*handler)(struct wfx_dev *wdev, struct hif_msg *hif, void *buf);

	int (*handler)(struct wfx_dev *wdev,

		       const struct hif_msg *hif, const void *buf);

} hif_handlers[] = {

	/* Confirmations */

	{ HIF_CNF_ID_TX,                   hif_tx_confirm },
@@ -335,7 +345,7 @@ static const struct { 
void wfx_handle_rx(struct wfx_dev *wdev, struct sk_buff *skb)

{

	int i;

	struct hif_msg *hif = (struct hif_msg *) skb->data;

	const struct hif_msg *hif = (const struct hif_msg *)skb->data;

	int hif_id = hif->id;



	if (hif_id == HIF_IND_ID_RX) {