⬢ DragonFlyBSD Kernel Audit
DF-1651 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
--- a/sys/dev/netif/sbsh/if_sbsh.c
+++ b/sys/dev/netif/sbsh/if_sbsh.c
@@ -411,16 +411,27 @@
 			       sizeof cfg);
 		if (error) {
 			/* fall out */
-		} else if (start_cx28975(sc, cfg) == 0) {
-			static char  *modstr[] = {
-				"TCPAM32", "TCPAM16", "TCPAM8", "TCPAM4" };
-			if_printf(&sc->arpcom.ac_if, "%s, rate %d, %s\n",
-				cfg.master ? "master" : "slave",
-				cfg.lrate << 3, modstr[cfg.mod]);
 		} else {
-			if_printf(&sc->arpcom.ac_if,
-				"unable to load firmware\n");
-			error = EIO;
+			u_int8_t *kfw;
+			kfw = kmalloc(cfg.firmw_len, M_DEVBUF, M_WAITOK);
+			if (copyin(cfg.firmw_image, kfw, cfg.firmw_len)) {
+				kfree(kfw, M_DEVBUF);
+				error = EFAULT;
+			} else {
+				cfg.firmw_image = kfw;
+				if (start_cx28975(sc, cfg) == 0) {
+					static char  *modstr[] = {
+						"TCPAM32", "TCPAM16", "TCPAM8", "TCPAM4" };
+					if_printf(&sc->arpcom.ac_if, "%s, rate %d, %s\n",
+						cfg.master ? "master" : "slave",
+						cfg.lrate << 3, modstr[cfg.mod]);
+				} else {
+					if_printf(&sc->arpcom.ac_if,
+						"unable to load firmware\n");
+					error = EIO;
+				}
+				kfree(kfw, M_DEVBUF);
+			}
 		}
 		break;