On Wed, 4 Jun 2008 19:13:46 +0000 "Justin Mattock" <justinmattock@gmail.com> wrote:
there's the kernel version
I get this:
y:/usr/src/25> AFLAGS=--32 /bin/sh scripts/decodecode < ~/x
Code: e9 8e 00 00 00 83 7d d0 32 bb 32 00 00 00 0f 4e 5d d0 ba d0 00 00 00 89 d8 e8 32 5b 5a c7 89 d9 8b 75 e0 c1 e9 02 89 45 d4 89 c7 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 45 d8 b9 a0 00 00 00 8b 10
/tmp/tmp.QXepc15200.o: file format elf32-i386
Disassembly of section .text:
00000000 <.text>:
0: e9 8e 00 00 00 jmp 0x93
5: 83 7d d0 32 cmpl $0x32,-0x30(%ebp)
9: bb 32 00 00 00 mov $0x32,%ebx
e: 0f 4e 5d d0 cmovle -0x30(%ebp),%ebx
12: ba d0 00 00 00 mov $0xd0,%edx
17: 89 d8 mov %ebx,%eax
19: e8 32 5b 5a c7 call 0xc75a5b50
1e: 89 d9 mov %ebx,%ecx
20: 8b 75 e0 mov -0x20(%ebp),%esi
23: c1 e9 02 shr $0x2,%ecx
26: 89 45 d4 mov %eax,-0x2c(%ebp)
29: 89 c7 mov %eax,%edi
/tmp/tmp.QXepc15200.o: file format elf32-i386
Disassembly of section .text:
00000000 <.text>:
0: f3 a5 rep movsl %ds:(%esi),%es:(%edi)
2: 89 d9 mov %ebx,%ecx
4: 83 e1 03 and $0x3,%ecx
7: 74 02 je 0xb
9: f3 a4 rep movsb %ds:(%esi),%es:(%edi)
b: 8b 45 d8 mov -0x28(%ebp),%eax
e: b9 a0 00 00 00 mov $0xa0,%ecx
13: 8b 10 mov (%eax),%edx
So at a guess I'd say that firnware->data is garbage (esi=f8dbf000).
But I didn't try very hard.
btw,
: static int isight_firmware_load(struct usb_interface *intf,
: const struct usb_device_id *id)
: {
: struct usb_device *dev = interface_to_usbdev(intf);
: int llen, len, req, ret = 0;
: const struct firmware *firmware;
: unsigned char *buf;
: unsigned char data[4];
: const u8 *ptr;
:
: if (request_firmware(&firmware, "isight.fw", &dev->dev) != 0) {
: printk(KERN_ERR "Unable to load isight firmware\n");
: return -ENODEV;
: }
:
: ptr = firmware->data;
:
: if (usb_control_msg
: (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
: 300) != 1) {
: printk(KERN_ERR
: "Failed to initialise isight firmware loader\n");
: ret = -ENODEV;
: goto out;
: }
:
: while (1) {
: memcpy(data, ptr, 4);
: len = (data[0] << 8 | data[1]);
: req = (data[2] << 8 | data[3]);
: ptr += 4;
:
: if (len == 0x8001)
: break; /* success */
: else if (len == 0)
: continue;
This looks like it can overrun the buffer and go oops if we were given
unexpected data.
: for (; len > 0; req += 50) {
: llen = len > 50 ? 50 : len;
min()
: len -= llen;
:
: buf = kmalloc(llen, GFP_KERNEL);
: memcpy(buf, ptr, llen);
:
: ptr += llen;
:
: if (usb_control_msg
: (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, req, 0,
: buf, llen, 300) != llen) {
: printk(KERN_ERR
: "Failed to load isight firmware\n");
: kfree(buf);
: ret = -ENODEV;
: goto out;
: }
:
: kfree(buf);
Could just kmalloc a single 50-byte buffer and then reuse it multiple times.
: }
: }
: if (usb_control_msg
: (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
: 300) != 1) {
: printk(KERN_ERR "isight firmware loading completion failed\n");
: ret = -ENODEV;
: }
: out:
: release_firmware(firmware);
: return ret;
: }
--
