package/carl9170/patches/110-endian_fixes.patch

   1 --- a/drivers/net/wireless/ath/carl9170/fw.c
   2 +++ b/drivers/net/wireless/ath/carl9170/fw.c
   3 @@ -39,7 +39,7 @@ const void *ar9170_fw_find_desc(struct a
   4         for_each_hdr(iter, ar->fw_desc) {
   5                 if (!memcmp(iter->magic, descid, sizeof(*descid)) &&
   6                     !CHECK_HDR_VERSION(iter, compatible_revision) &&
   7 -                   (iter->length >= len)) {
   8 +                   (le16_to_cpu(iter->length) >= len)) {
   9                         ret = (void *)iter;
  10                         break;
  11                 }
  12 @@ -63,20 +63,22 @@ static int ar9170_fw_verify_descs(struct
  13         end = (void *) head + max_len;
  14
  15         while (pos < end) {
  16 -               if (((unsigned long)pos + pos->length) > (unsigned long)end)
  17 +               int pos_length = le16_to_cpu(pos->length);
  18 +
  19 +               if (((unsigned long)pos + pos_length) > (unsigned long)end)
  20                         return -EMSGSIZE;
  21
  22 -               if (pos->length > max_len)
  23 +               if (pos_length > max_len)
  24                         return -EMSGSIZE;
  25
  26 -               if (pos->length < sizeof(struct carl9170_fw_desc_head))
  27 +               if (pos_length < sizeof(struct carl9170_fw_desc_head))
  28                         return -EINVAL;
  29
  30                 if (!memcmp(pos->magic, last_magic, sizeof(last_magic)))
  31                         return 0;
  32
  33 -               pos = (void *)((unsigned long)pos + pos->length);
  34 -               max_len -= pos->length;
  35 +               pos = (void *)((unsigned long)pos + pos_length);
  36 +               max_len -= le16_to_cpu(pos->length);
  37         }
  38
  39         return -EINVAL;
  40 @@ -139,7 +141,7 @@ static int ar9170_fw_check(struct ar9170
  41         if (SUPP(CARL9170_FW_CRC32_CHECKSUM_TAIL)) {
  42                 __le32 crc32;
  43
  44 -               crc32 = crc32_le(~0, data, len - 4);
  45 +               crc32 = cpu_to_le32(crc32_le(~0, data, len - 4));
  46                 if (!memcmp(&crc32, &data[len - 4], 4) == 0) {
  47                         dev_err(ar->pdev, "CRC32 checksum mismatch!\n");
  48                         return -EINVAL;
  49 --- a/drivers/net/wireless/ath/carl9170/fwhdr.h
  50 +++ b/drivers/net/wireless/ath/carl9170/fwhdr.h
  51 @@ -196,7 +196,7 @@ struct carl9170_fw_last_desc_v1 {
  52  #define for_each_hdr(desc, fw_desc)                                    \
  53         for (desc = fw_desc;                                            \
  54              (memcmp(desc->magic, LAST_MAGIC, 4) && desc->length);      \
  55 -            desc = (void *)((unsigned long)desc + desc->length))
  56 +            desc = (void *)((unsigned long)desc + le16_to_cpu(desc->length)))
  57
  58  #define CHECK_HDR_VERSION(head, _min_ver)                              \
  59         (((head)->cur_ver < _min_ver) || ((head)->min_ver > _min_ver))  \
  60 --- a/drivers/net/wireless/ath/carl9170/usb.c
  61 +++ b/drivers/net/wireless/ath/carl9170/usb.c
  62 @@ -640,9 +640,10 @@ static int ar9170_usb_check_firmware(str
  63         }
  64
  65         if ((usb_desc->tx_descs < 16) ||
  66 -           (usb_desc->tx_frag_len < 64) || (usb_desc->tx_frag_len > 512) ||
  67 -           (usb_desc->rx_max_frame_len < 1024) ||
  68 -           (usb_desc->rx_max_frame_len > AR9170_MAX_RX_BUFFER_SIZE)) {
  69 +           (le16_to_cpu(usb_desc->tx_frag_len) < 64) ||
  70 +               (le16_to_cpu(usb_desc->tx_frag_len) > 512) ||
  71 +           (le16_to_cpu(usb_desc->rx_max_frame_len) < 1024) ||
  72 +           (le16_to_cpu(usb_desc->rx_max_frame_len) > AR9170_MAX_RX_BUFFER_SIZE)) {
  73                 dev_err(&aru->udev->dev, "usb firmware has obvious signs of "
  74                                          "malicious tampering.\n");
  75                 err = -EINVAL;
  76 @@ -650,14 +651,14 @@ static int ar9170_usb_check_firmware(str
  77         }
  78
  79         if (SUPP(CARL9170_FW_USB_MINIBOOT))
  80 -               aru->fw_offset = usb_desc->miniboot_size;
  81 +               aru->fw_offset = le16_to_cpu(usb_desc->miniboot_size);
  82         else
  83                 aru->fw_offset = 0;
  84
  85 -       aru->rx_size = usb_desc->rx_max_frame_len;
  86 +       aru->rx_size = le16_to_cpu(usb_desc->rx_max_frame_len);
  87         aru->common.mem_blocks = usb_desc->tx_descs;
  88         atomic_set(&aru->common.mem_free_blocks, usb_desc->tx_descs);
  89 -       aru->common.mem_block_size = usb_desc->tx_frag_len;
  90 +       aru->common.mem_block_size = le16_to_cpu(usb_desc->tx_frag_len);
  91         return 0;
  92
  93  fail: