From beec968224bfafbde7c6413a5f27a4477a7ea228 Mon Sep 17 00:00:00 2001 From: Mahesh Kumar Kalikot Veetil Date: Mon, 10 May 2021 15:12:44 -0700 Subject: [PATCH] cnss2: Fix invalid assignment due to type mismatch The firmware size returned by request_firmware api is size_t which is unsigned long in some platforms. Typeacast the size to u32 to match with supported interface definition. Change-Id: I61a484e74bf7932508295aac2fe7cfd7298d7953 Signed-off-by: Mahesh Kumar Kalikot Veetil --- drivers/net/wireless/cnss2/qmi.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/cnss2/qmi.c b/drivers/net/wireless/cnss2/qmi.c index 1e5a6c911e6a..8a1dd4671fea 100644 --- a/drivers/net/wireless/cnss2/qmi.c +++ b/drivers/net/wireless/cnss2/qmi.c @@ -586,7 +586,7 @@ int cnss_wlfw_bdf_dnld_send_sync(struct cnss_plat_data *plat_priv, char filename[MAX_FIRMWARE_NAME_LEN]; const struct firmware *fw_entry = NULL; const u8 *temp; - unsigned int remaining; + u32 remaining; int ret = 0; cnss_pr_dbg("Sending BDF download message, state: 0x%lx, type: %d\n", @@ -620,7 +620,13 @@ int cnss_wlfw_bdf_dnld_send_sync(struct cnss_plat_data *plat_priv, } temp = fw_entry->data; - remaining = fw_entry->size; + + /* Check if firmware image size is within expected range */ + if (fw_entry->size > U32_MAX) + goto err_send; + + /* Typecast to match with interface defintition */ + remaining = (u32)fw_entry->size; cnss_pr_dbg("Downloading BDF: %s, size: %u\n", filename, remaining); @@ -845,7 +851,7 @@ int cnss_wlfw_qdss_data_send_sync(struct cnss_plat_data *plat_priv, char *file_n struct wlfw_qdss_trace_data_req_msg_v01 *req; struct wlfw_qdss_trace_data_resp_msg_v01 *resp; unsigned char *p_qdss_trace_data_temp, *p_qdss_trace_data = NULL; - unsigned int remaining; + u32 remaining; struct qmi_txn txn; cnss_pr_dbg("%s\n", __func__); @@ -1002,7 +1008,7 @@ int cnss_wlfw_qdss_dnld_send_sync(struct cnss_plat_data *plat_priv) const struct firmware *fw_entry = NULL; const u8 *temp; char qdss_cfg_filename[MAX_FIRMWARE_NAME_LEN]; - unsigned int remaining; + u32 remaining; int ret = 0; cnss_pr_dbg("Sending QDSS config download message, state: 0x%lx\n", @@ -1028,7 +1034,13 @@ int cnss_wlfw_qdss_dnld_send_sync(struct cnss_plat_data *plat_priv) } temp = fw_entry->data; - remaining = fw_entry->size; + + /* Check if firmware image size is within expected range */ + if (fw_entry->size > U32_MAX) + goto err_send; + + /* Typecast to match with interface definition */ + remaining = (u32)fw_entry->size; cnss_pr_dbg("Downloading QDSS: %s, size: %u\n", qdss_cfg_filename, remaining);