Commit a1b8a9bb authored by Fabio Aiuto's avatar Fabio Aiuto Committed by Greg Kroah-Hartman
Browse files

staging: rtl8723bs: moved contexts for arc4 encryption in struct security_priv 



moved struct arc4_ctx in struct security_priv to avoid stack allocation
inside encryption routines.

this has been done to fix the following 0-DAY issues:

>> drivers/staging/rtl8723bs/core/rtw_security.c:89:6: warning:
stack frame size of 1120 bytes in function 'rtw_wep_encrypt'
[-Wframe-$
   void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
        ^
>> drivers/staging/rtl8723bs/core/rtw_security.c:145:6:
warning: stack frame size of 1088 bytes in function 'rtw_wep_decrypt'
[-Wframe$
   void rtw_wep_decrypt(struct adapter  *padapter, u8 *precvframe)
        ^
>> drivers/staging/rtl8723bs/core/rtw_security.c:514:5:
warning: stack frame size of 1136 bytes in function 'rtw_tkip_encrypt'
[-Wfram$
   u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
       ^
>> drivers/staging/rtl8723bs/core/rtw_security.c:586:5:
warning: stack frame size of 1104 bytes in function 'rtw_tkip_decrypt'
[-Wfram$
   u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
       ^

Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarFabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/20210521144158.2440-1-fabioaiuto83@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1b4c0f3b

drivers/staging/rtl8723bs/core/rtw_security.c

+20 −21
Original line number Diff line number Diff line
@@ -8,7 +8,6 @@ 
#include <drv_types.h>

#include <rtw_debug.h>

#include <crypto/aes.h>

#include <crypto/arc4.h>



static const char * const _security_type_str[] = {

	"N/A",
@@ -38,7 +37,6 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe) 
{																	/*  exclude ICV */



	unsigned char crc[4];

	struct arc4_ctx	mycontext;



	signed int	curfragnum, length;

	u32 keylength;
@@ -49,6 +47,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe) 
	struct pkt_attrib *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;

	struct security_priv *psecuritypriv = &padapter->securitypriv;

	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;

	struct arc4_ctx *ctx = &psecuritypriv->xmit_arc4_ctx;



	if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)

		return;
@@ -72,16 +71,16 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe) 


				*((__le32 *)crc) = ~crc32_le(~0, payload, length);



				arc4_setkey(&mycontext, wepkey, 3 + keylength);

				arc4_crypt(&mycontext, payload, payload, length);

				arc4_crypt(&mycontext, payload + length, crc, 4);

				arc4_setkey(ctx, wepkey, 3 + keylength);

				arc4_crypt(ctx, payload, payload, length);

				arc4_crypt(ctx, payload + length, crc, 4);



			} else {

				length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;

				*((__le32 *)crc) = ~crc32_le(~0, payload, length);

				arc4_setkey(&mycontext, wepkey, 3 + keylength);

				arc4_crypt(&mycontext, payload, payload, length);

				arc4_crypt(&mycontext, payload + length, crc, 4);

				arc4_setkey(ctx, wepkey, 3 + keylength);

				arc4_crypt(ctx, payload, payload, length);

				arc4_crypt(ctx, payload + length, crc, 4);



				pframe += pxmitpriv->frag_len;

				pframe = (u8 *)round_up((SIZE_PTR)(pframe), 4);
@@ -94,13 +93,13 @@ void rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) 
{

	/*  exclude ICV */

	u8 crc[4];

	struct arc4_ctx	 mycontext;

	signed int	length;

	u32 keylength;

	u8 *pframe, *payload, *iv, wepkey[16];

	u8  keyindex;

	struct	rx_pkt_attrib	 *prxattrib = &(((union recv_frame *)precvframe)->u.hdr.attrib);

	struct	security_priv *psecuritypriv = &padapter->securitypriv;

	struct arc4_ctx *ctx = &psecuritypriv->recv_arc4_ctx;



	pframe = (unsigned char *)((union recv_frame *)precvframe)->u.hdr.rx_data;
@@ -118,8 +117,8 @@ void rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe) 
		payload = pframe+prxattrib->iv_len+prxattrib->hdrlen;



		/* decrypt payload include icv */

		arc4_setkey(&mycontext, wepkey, 3 + keylength);

		arc4_crypt(&mycontext, payload, payload,  length);

		arc4_setkey(ctx, wepkey, 3 + keylength);

		arc4_crypt(ctx, payload, payload,  length);



		/* calculate icv and compare the icv */

		*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));
@@ -467,7 +466,6 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe) 
	u8   ttkey[16];

	u8 crc[4];

	u8   hw_hdr_offset = 0;

	struct arc4_ctx mycontext;

	signed int			curfragnum, length;



	u8 *pframe, *payload, *iv, *prwskey;
@@ -475,6 +473,7 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe) 
	struct pkt_attrib *pattrib = &((struct xmit_frame *)pxmitframe)->attrib;

	struct security_priv *psecuritypriv = &padapter->securitypriv;

	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;

	struct arc4_ctx *ctx = &psecuritypriv->xmit_arc4_ctx;

	u32 res = _SUCCESS;



	if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
@@ -509,17 +508,17 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe) 
					length = pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;

					*((__le32 *)crc) = ~crc32_le(~0, payload, length);



					arc4_setkey(&mycontext, rc4key, 16);

					arc4_crypt(&mycontext, payload, payload, length);

					arc4_crypt(&mycontext, payload + length, crc, 4);

					arc4_setkey(ctx, rc4key, 16);

					arc4_crypt(ctx, payload, payload, length);

					arc4_crypt(ctx, payload + length, crc, 4);



				} else {

					length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;

					*((__le32 *)crc) = ~crc32_le(~0, payload, length);



					arc4_setkey(&mycontext, rc4key, 16);

					arc4_crypt(&mycontext, payload, payload, length);

					arc4_crypt(&mycontext, payload + length, crc, 4);

					arc4_setkey(ctx, rc4key, 16);

					arc4_crypt(ctx, payload, payload, length);

					arc4_crypt(ctx, payload + length, crc, 4);



					pframe += pxmitpriv->frag_len;

					pframe = (u8 *)round_up((SIZE_PTR)(pframe), 4);
@@ -539,7 +538,6 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) 
	u8   rc4key[16];

	u8   ttkey[16];

	u8 crc[4];

	struct arc4_ctx mycontext;

	signed int			length;



	u8 *pframe, *payload, *iv, *prwskey;
@@ -547,6 +545,7 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) 
	struct sta_info *stainfo;

	struct rx_pkt_attrib *prxattrib = &((union recv_frame *)precvframe)->u.hdr.attrib;

	struct security_priv *psecuritypriv = &padapter->securitypriv;

	struct arc4_ctx *ctx = &psecuritypriv->recv_arc4_ctx;

	u32 res = _SUCCESS;



	pframe = (unsigned char *)((union recv_frame *)precvframe)->u.hdr.rx_data;
@@ -616,8 +615,8 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe) 


			/* 4 decrypt payload include icv */



			arc4_setkey(&mycontext, rc4key, 16);

			arc4_crypt(&mycontext, payload, payload, length);

			arc4_setkey(ctx, rc4key, 16);

			arc4_crypt(ctx, payload, payload, length);



			*((u32 *)crc) = le32_to_cpu(~crc32_le(~0, payload, length - 4));

drivers/staging/rtl8723bs/include/rtw_security.h

+3 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ 
#ifndef __RTW_SECURITY_H_

#define __RTW_SECURITY_H_



#include <crypto/arc4.h>



#define _NO_PRIVACY_		0x0

#define _WEP40_				0x1
@@ -127,6 +128,8 @@ struct security_priv { 
	u8 wps_ie[MAX_WPS_IE_LEN];/* added in assoc req */

	int wps_ie_len;



	struct arc4_ctx xmit_arc4_ctx;

	struct arc4_ctx recv_arc4_ctx;



	u8 binstallGrpkey;

	u8 binstallBIPkey;