[PATCH v3] staging: kpc2000: remove unnecessary assertions in kpc_dma_transfer

[Aditya Pakki]

In kpc_dma_transfer(), the assertion that priv is NULL and priv->ldev
is NULL, are never satisfied. The two callers of the function,
dereference the fields before the function is called. This patch
removes the two BUG_ON calls.

Signed-off-by: Aditya Pakki 
---
v2: Also remove BUG_ON call for ldev, suggested by Greg.

v1: Replace the recovery code by removing the assertion, as suggested
by Greg Kroah-Hartman.
---
 drivers/staging/kpc2000/kpc_dma/fileops.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c 
b/drivers/staging/kpc2000/kpc_dma/fileops.c
index cb52bd9a6d2f..40525540dde6 100644
--- a/drivers/staging/kpc2000/kpc_dma/fileops.c
+++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
@@ -49,9 +49,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
u64 dma_addr;
u64 user_ctl;
 
-   BUG_ON(priv == NULL);
ldev = priv->ldev;
-   BUG_ON(ldev == NULL);
 
acd = kzalloc(sizeof(*acd), GFP_KERNEL);
if (!acd) {
-- 
2.20.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2] staging: kpc2000: remove unnecessary assertion on priv

[Aditya Pakki]

In kpc_dma_transfer(), the assertion that priv is NULL is never
satisfied. The two callers of the function, dereference the priv
pointer before the call is executed. This patch removes the
unnecessary BUG_ON call.

Signed-off-by: Aditya Pakki 
---
v1: Replace the recovery code by removing the assertion, as suggested
by Greg Kroah-Hartman.
---
 drivers/staging/kpc2000/kpc_dma/fileops.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c 
b/drivers/staging/kpc2000/kpc_dma/fileops.c
index cb52bd9a6d2f..61d762535823 100644
--- a/drivers/staging/kpc2000/kpc_dma/fileops.c
+++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
@@ -49,7 +49,6 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
u64 dma_addr;
u64 user_ctl;
 
-   BUG_ON(priv == NULL);
ldev = priv->ldev;
BUG_ON(ldev == NULL);
 
-- 
2.20.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] staging: kpc2000: replace assertion with recovery code

[Aditya Pakki]

In kpc_dma_transfer, if either priv or ldev is NULL, crashing the
process is excessive and is not needed. Instead of asserting, by
passing the error upstream, the error can be handled.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/kpc2000/kpc_dma/fileops.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c 
b/drivers/staging/kpc2000/kpc_dma/fileops.c
index cb52bd9a6d2f..1c4633267cc1 100644
--- a/drivers/staging/kpc2000/kpc_dma/fileops.c
+++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
@@ -49,9 +49,11 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
u64 dma_addr;
u64 user_ctl;
 
-   BUG_ON(priv == NULL);
+   if (!priv)
+   return -EINVAL;
ldev = priv->ldev;
-   BUG_ON(ldev == NULL);
+   if (!ldev)
+   return -EINVAL;
 
acd = kzalloc(sizeof(*acd), GFP_KERNEL);
if (!acd) {
-- 
2.20.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v3] staging: rtl8188eu: Fix potential NULL pointer dereference of kcalloc

[Aditya Pakki]

hwxmits is allocated via kcalloc and not checked for failure before its
dereference. The patch fixes this problem by returning error upstream
in rtl8723bs, rtl8188eu.

Signed-off-by: Aditya Pakki 

---
v2: Move signed off above version change log.
v1: Return error and remove print in case of failure, per Greg
---
 drivers/staging/rtl8188eu/core/rtw_xmit.c|  9 +++--
 drivers/staging/rtl8188eu/include/rtw_xmit.h |  2 +-
 drivers/staging/rtl8723bs/core/rtw_xmit.c| 14 +++---
 drivers/staging/rtl8723bs/include/rtw_xmit.h |  2 +-
 4 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c 
b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 1723a47a96b4..952f2ab51347 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -174,7 +174,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct 
adapter *padapter)
 
pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
 
-   rtw_alloc_hwxmits(padapter);
+   res = rtw_alloc_hwxmits(padapter);
+   if (res == _FAIL)
+   goto exit;
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
for (i = 0; i < 4; i++)
@@ -1503,7 +1505,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct 
xmit_frame *pxmitframe)
return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = >xmitpriv;
@@ -1512,6 +1514,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
 sizeof(struct hw_xmit), GFP_KERNEL);
+   if (!pxmitpriv->hwxmits)
+   return _FAIL;
 
hwxmits = pxmitpriv->hwxmits;
 
@@ -1519,6 +1523,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
hwxmits[1] .sta_queue = >vi_pending;
hwxmits[2] .sta_queue = >be_pending;
hwxmits[3] .sta_queue = >bk_pending;
+   return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8188eu/include/rtw_xmit.h 
b/drivers/staging/rtl8188eu/include/rtw_xmit.h
index 788f59c74ea1..ba7e15fbde72 100644
--- a/drivers/staging/rtl8188eu/include/rtw_xmit.h
+++ b/drivers/staging/rtl8188eu/include/rtw_xmit.h
@@ -336,7 +336,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,
 void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);
 s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *padapter);
 void rtw_free_hwxmits(struct adapter *padapter);
 s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);
 
diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c 
b/drivers/staging/rtl8723bs/core/rtw_xmit.c
index 094d61bcb469..b87f13a0b563 100644
--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c
+++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c
@@ -260,7 +260,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct 
adapter *padapter)
}
}
 
-   rtw_alloc_hwxmits(padapter);
+   res = rtw_alloc_hwxmits(padapter);
+   if (res == _FAIL)
+   goto exit;
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
for (i = 0; i < 4; i++) {
@@ -2144,7 +2146,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct 
xmit_frame *pxmitframe)
return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = >xmitpriv;
@@ -2155,10 +2157,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * 
pxmitpriv->hwxmit_entry);
 
-   if (pxmitpriv->hwxmits == NULL) {
-   DBG_871X("alloc hwxmits fail!...\n");
-   return;
-   }
+   if (!pxmitpriv->hwxmits)
+   return _FAIL;
 
hwxmits = pxmitpriv->hwxmits;
 
@@ -2204,7 +2204,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
}
 
-
+   return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/include/rtw_xmit.h 
b/drivers/staging/rtl8723bs/include/rtw_xmit.h
index 1b38b9182b31..37f42b2f22f1 100644
--- a/drivers/staging/rtl8723bs/include/rtw_xmit.h
+++ b/drivers/staging/rtl8723bs/include/rtw_xmit.h
@@ -487,7 +487,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct 
adapter *padapter);
 void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
 
 
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *pa

[PATCH v3] staging: rtlwifi: rtl8822b: fix to avoid NULL pointer dereference

[Aditya Pakki]

skb allocated via dev_alloc_skb can fail and return a NULL pointer.
This patch avoids such a scenario and returns, consistent with other
invocations.

Signed-off-by: Aditya Pakki 

---
v2: Move signed off above the version change log
v1: Patch collision with rtl_phydm.c, fix as per Greg
---
 drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c 
b/drivers/staging/rtlwifi/rtl8822be/fw.c
index f061dd1382aa..cf6b7a80b753 100644
--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
@@ -743,6 +743,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, 
bool b_dl_finished)
  u1_rsvd_page_loc, 3);
 
skb = dev_alloc_skb(totalpacketlen);
+   if (!skb)
+   return;
memcpy((u8 *)skb_put(skb, totalpacketlen), _page_packet,
   totalpacketlen);
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v3] staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc

[Aditya Pakki]

phydm.internal is allocated using kzalloc which is used multiple
times without a check for NULL pointer. This patch avoids such a
scenario by returning 0, consistent with the failure case.

Signed-off-by: Aditya Pakki 

---
v2: Move the signed off line above
v1: Patch collision with different things, fix as per Greg
---
 drivers/staging/rtlwifi/phydm/rtl_phydm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c 
b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
index 9930ed954abb..4cc77b2016e1 100644
--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
@@ -180,6 +180,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
 
rtlpriv->phydm.internal =
kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
+   if (!rtlpriv->phydm.internal)
+   return 0;
 
_rtl_phydm_init_com_info(rtlpriv, ic, params);
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2] staging: rtl8188eu: Fix potential NULL pointer dereference

[Aditya Pakki]

hwxmits is allocated via kcalloc and not checked for failure before its
dereference. The patch fixes this problem by returning an error in
rtl8723bs.

---
v1: Return error and remove print in case of failure, per Greg
Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtl8188eu/core/rtw_xmit.c| 10 --
 drivers/staging/rtl8188eu/include/rtw_xmit.h |  2 +-
 drivers/staging/rtl8723bs/core/rtw_xmit.c| 14 +++---
 drivers/staging/rtl8723bs/include/rtw_xmit.h |  2 +-
 4 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c 
b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 1723a47a96b4..b70a87bda6f8 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -174,7 +174,10 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, 
struct adapter *padapter)
 
pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf;
 
-   rtw_alloc_hwxmits(padapter);
+   res = rtw_alloc_hwxmits(padapter);
+   if (res == _FAIL)
+   goto exit;
+
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
for (i = 0; i < 4; i++)
@@ -1503,7 +1506,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct 
xmit_frame *pxmitframe)
return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = >xmitpriv;
@@ -1512,6 +1515,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
 sizeof(struct hw_xmit), GFP_KERNEL);
+   if (!pxmitpriv->hwxmits)
+   return _FAIL;
 
hwxmits = pxmitpriv->hwxmits;
 
@@ -1519,6 +1524,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
hwxmits[1] .sta_queue = >vi_pending;
hwxmits[2] .sta_queue = >be_pending;
hwxmits[3] .sta_queue = >bk_pending;
+   return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8188eu/include/rtw_xmit.h 
b/drivers/staging/rtl8188eu/include/rtw_xmit.h
index 788f59c74ea1..ba7e15fbde72 100644
--- a/drivers/staging/rtl8188eu/include/rtw_xmit.h
+++ b/drivers/staging/rtl8188eu/include/rtw_xmit.h
@@ -336,7 +336,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,
 void rtw_init_hwxmits(struct hw_xmit *phwxmit, int entry);
 s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter);
 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv);
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *padapter);
 void rtw_free_hwxmits(struct adapter *padapter);
 s32 rtw_xmit(struct adapter *padapter, struct sk_buff **pkt);
 
diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c 
b/drivers/staging/rtl8723bs/core/rtw_xmit.c
index 094d61bcb469..b87f13a0b563 100644
--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c
+++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c
@@ -260,7 +260,9 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct 
adapter *padapter)
}
}
 
-   rtw_alloc_hwxmits(padapter);
+   res = rtw_alloc_hwxmits(padapter);
+   if (res == _FAIL)
+   goto exit;
rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
for (i = 0; i < 4; i++) {
@@ -2144,7 +2146,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct 
xmit_frame *pxmitframe)
return res;
 }
 
-void rtw_alloc_hwxmits(struct adapter *padapter)
+s32 rtw_alloc_hwxmits(struct adapter *padapter)
 {
struct hw_xmit *hwxmits;
struct xmit_priv *pxmitpriv = >xmitpriv;
@@ -2155,10 +2157,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * 
pxmitpriv->hwxmit_entry);
 
-   if (pxmitpriv->hwxmits == NULL) {
-   DBG_871X("alloc hwxmits fail!...\n");
-   return;
-   }
+   if (!pxmitpriv->hwxmits)
+   return _FAIL;
 
hwxmits = pxmitpriv->hwxmits;
 
@@ -2204,7 +2204,7 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
}
 
-
+   return _SUCCESS;
 }
 
 void rtw_free_hwxmits(struct adapter *padapter)
diff --git a/drivers/staging/rtl8723bs/include/rtw_xmit.h 
b/drivers/staging/rtl8723bs/include/rtw_xmit.h
index 1b38b9182b31..37f42b2f22f1 100644
--- a/drivers/staging/rtl8723bs/include/rtw_xmit.h
+++ b/drivers/staging/rtl8723bs/include/rtw_xmit.h
@@ -487,7 +487,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct 
adapter *padapter);
 void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv);
 
 
-void rtw_alloc_hwxmits(struct adapter *padapter);
+s32 rtw_alloc_hwxmits(struct adapter *padapter);
 void rtw_free_hwxmits(struct adapter *padapter);
 
 
-- 
2.17.1

___

[PATCH v2] staging: rtlwifi: rtl8822b: fix to avoid NULL pointer dereference

[Aditya Pakki]

skb allocated via dev_alloc_skb can fail and return a NULL pointer.
This patch avoids such a scenario and returns, consistent with other
invocations.

---
v1: Patch collision with rtl_phydm.c, fix as per Greg
Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c 
b/drivers/staging/rtlwifi/rtl8822be/fw.c
index f061dd1382aa..cf6b7a80b753 100644
--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
@@ -743,6 +743,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, 
bool b_dl_finished)
  u1_rsvd_page_loc, 3);
 
skb = dev_alloc_skb(totalpacketlen);
+   if (!skb)
+   return;
memcpy((u8 *)skb_put(skb, totalpacketlen), _page_packet,
   totalpacketlen);
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH v2] staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc

[Aditya Pakki]

phydm.internal is allocated using kzalloc which is used multiple
times without a check for NULL pointer. This patch avoids such a
scenario.

--
v1: Patch collision with different things, fix as per Greg
Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtlwifi/phydm/rtl_phydm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c 
b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
index 9930ed954abb..a7932706f286 100644
--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
@@ -180,6 +180,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
 
rtlpriv->phydm.internal =
kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
+   if (!rtlpriv->phydm.internal)
+   return -ENOMEM;
 
_rtl_phydm_init_com_info(rtlpriv, ic, params);
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] staging: rtl8188eu: Fix potential NULL pointer dereference

[Aditya Pakki]

hwxmits is allocated via kcalloc and not checked for failure before its
dereference. The patch fixes this problem similar to rtl8723bs.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtl8188eu/core/rtw_xmit.c | 4 
 1 file changed, 4 insertions(+)

diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c 
b/drivers/staging/rtl8188eu/core/rtw_xmit.c
index 1723a47a96b4..a557ed37923a 100644
--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c
+++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c
@@ -1512,6 +1512,10 @@ void rtw_alloc_hwxmits(struct adapter *padapter)
 
pxmitpriv->hwxmits = kcalloc(pxmitpriv->hwxmit_entry,
 sizeof(struct hw_xmit), GFP_KERNEL);
+   if (!pxmitpriv->hwxmits) {
+   DBG_88E("alloc hwxmits fail!...\n");
+   return;
+   }
 
hwxmits = pxmitpriv->hwxmits;
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] staging: rtlwifi: Fix potential NULL pointer dereference

[Aditya Pakki]

skb allocated via dev_alloc_skb can fail and return a NULL pointer.
This patch avoids such a scenario and returns, consistent with other
invocations.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtlwifi/rtl8822be/fw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c 
b/drivers/staging/rtlwifi/rtl8822be/fw.c
index f061dd1382aa..8fab9c8d1dd0 100644
--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
@@ -743,6 +743,9 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, 
bool b_dl_finished)
  u1_rsvd_page_loc, 3);
 
skb = dev_alloc_skb(totalpacketlen);
+   if (!skb)
+   return;
+
memcpy((u8 *)skb_put(skb, totalpacketlen), _page_packet,
   totalpacketlen);
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] staging: rtlwifi: Fix potential NULL pointer dereference

[Aditya Pakki]

phydm.internal is allocated using kzalloc which is used multiple
times without a check for NULL pointer. This patch avoids such a
scenario.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtlwifi/phydm/rtl_phydm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c 
b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
index 9930ed954abb..37c7fcb72b65 100644
--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
@@ -181,6 +181,9 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
rtlpriv->phydm.internal =
kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
 
+   if (!rtlpriv->phydm.internal)
+   return -ENOMEM;
+
_rtl_phydm_init_com_info(rtlpriv, ic, params);
 
odm_init_all_timers(dm);
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] [v3] staging: rtl8723bs: Clean up dead code

[Aditya Pakki]

rtw_wps_start() is part of dead code due to CONFIG_INTEL_WIDI.
The fix removes the deadcode and replaces the function with NULL
in rtw_private_handler. Identified as part of copy_from_user bug.

Changes from v1 & 2:
The return value of copy_from_user() is not checked appropriately.
However, maintainers identified the patch fixing the issue is not
required as function rts_wps_start() is dead code and can be removed.

Signed-off-by: Aditya Pakki 
---
 .../staging/rtl8723bs/os_dep/ioctl_linux.c| 34 +--
 1 file changed, 1 insertion(+), 33 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c 
b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 8fb03efd588b..2621c47f343f 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2568,38 +2568,6 @@ static int rtw_set_pid(struct net_device *dev,
 
 }
 
-static int rtw_wps_start(struct net_device *dev,
-   struct iw_request_info *info,
-   union iwreq_data *wrqu, char *extra)
-{
-
-   int ret = 0;
-   struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
-   struct iw_point *pdata = >data;
-   u32   u32wps_start = 0;
-unsigned int uintRet = 0;
-
-   if ((true == padapter->bDriverStopped) ||(true 
==padapter->bSurpriseRemoved) || (NULL == pdata)) {
-   ret = -EINVAL;
-   goto exit;
-   }
-
-   uintRet = copy_from_user((void*)_start, pdata->pointer, 4);
-   if (u32wps_start == 0)
-   u32wps_start = *extra;
-
-   DBG_871X("[%s] wps_start = %d\n", __func__, u32wps_start);
-
-#ifdef CONFIG_INTEL_WIDI
-   process_intel_widi_wps_status(padapter, u32wps_start);
-#endif /* CONFIG_INTEL_WIDI */
-
-exit:
-
-   return ret;
-
-}
-
 static int rtw_p2p_set(struct net_device *dev,
struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
@@ -4820,7 +4788,7 @@ static iw_handler rtw_private_handler[] = {
rtw_get_ap_info,/* 0x04 */
 
rtw_set_pid,/* 0x05 */
-   rtw_wps_start,  /* 0x06 */
+   NULL,   /* 0x06 */
 
 /*  for PLATFORM_MT53XX */
rtw_wx_get_sensitivity, /* 0x07 */
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] v2 staging: rtl8723bs: Clean up dead code

[Aditya Pakki]

rtw_wps_start() is part of dead code due to CONFIG_INTEL_WIDI.
The fix removes the deadcode and replaces the function with NULL
in rtw_private_handler. Identified as part of copy_from_user bug.

Signed-off-by: Aditya Pakki 
---
 .../staging/rtl8723bs/os_dep/ioctl_linux.c| 34 +--
 1 file changed, 1 insertion(+), 33 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c 
b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 8fb03efd588b..2621c47f343f 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2568,38 +2568,6 @@ static int rtw_set_pid(struct net_device *dev,
 
 }
 
-static int rtw_wps_start(struct net_device *dev,
-   struct iw_request_info *info,
-   union iwreq_data *wrqu, char *extra)
-{
-
-   int ret = 0;
-   struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
-   struct iw_point *pdata = >data;
-   u32   u32wps_start = 0;
-unsigned int uintRet = 0;
-
-   if ((true == padapter->bDriverStopped) ||(true 
==padapter->bSurpriseRemoved) || (NULL == pdata)) {
-   ret = -EINVAL;
-   goto exit;
-   }
-
-   uintRet = copy_from_user((void*)_start, pdata->pointer, 4);
-   if (u32wps_start == 0)
-   u32wps_start = *extra;
-
-   DBG_871X("[%s] wps_start = %d\n", __func__, u32wps_start);
-
-#ifdef CONFIG_INTEL_WIDI
-   process_intel_widi_wps_status(padapter, u32wps_start);
-#endif /* CONFIG_INTEL_WIDI */
-
-exit:
-
-   return ret;
-
-}
-
 static int rtw_p2p_set(struct net_device *dev,
struct iw_request_info *info,
union iwreq_data *wrqu, char *extra)
@@ -4820,7 +4788,7 @@ static iw_handler rtw_private_handler[] = {
rtw_get_ap_info,/* 0x04 */
 
rtw_set_pid,/* 0x05 */
-   rtw_wps_start,  /* 0x06 */
+   NULL,   /* 0x06 */
 
 /*  for PLATFORM_MT53XX */
rtw_wx_get_sensitivity, /* 0x07 */
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] Staging: rts5208: Fix error handling on rtsx_send_cmd

[Aditya Pakki]

In sd_execute_write_data, the rtsx_send_cmd could fail with ETIMEDOUT
or EIO. The fix adds a check to handle these failures.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rts5208/sd.c | 7 ++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
index 2c47ae613ea1..c256a2398651 100644
--- a/drivers/staging/rts5208/sd.c
+++ b/drivers/staging/rts5208/sd.c
@@ -4437,7 +4437,12 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct 
rtsx_chip *chip)
rtsx_init_cmd(chip);
rtsx_add_cmd(chip, CHECK_REG_CMD, 0xFD30, 0x02, 0x02);
 
-   rtsx_send_cmd(chip, SD_CARD, 250);
+   retval = rtsx_send_cmd(chip, SD_CARD, 250);
+   if (retval < 0) {
+   write_err = true;
+   rtsx_clear_sd_error(chip);
+   goto sd_execute_write_cmd_failed;
+   }
 
retval = sd_update_lock_status(chip);
if (retval != STATUS_SUCCESS) {
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] staging: rts5208: Add a check for ms_read_extra_data

[Aditya Pakki]

In ms_copy_page, the function ms_read_extra_data may fail for many
reasons. The fix adds a check similar to other invocation to return
error upstream.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rts5208/ms.c | 5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index 04b588b8b376..8eb6221e4cc8 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/staging/rts5208/ms.c
@@ -1676,7 +1676,10 @@ static int ms_copy_page(struct rtsx_chip *chip, u16 
old_blk, u16 new_blk,
return STATUS_FAIL;
}
 
-   ms_read_extra_data(chip, old_blk, i, extra, MS_EXTRA_SIZE);
+   retval = ms_read_extra_data(chip, old_blk, i, extra,
+   MS_EXTRA_SIZE);
+   if (retval != STATUS_SUCCESS)
+   return STATUS_FAIL;
 
retval = ms_set_rw_reg_addr(chip, OverwriteFlag,
MS_EXTRA_SIZE, SystemParm, 6);
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] rts5208: Add a check on the status of ms_send_cmd

[Aditya Pakki]

In mspro_stop_seq_mode(), ms_send_cmd() may fail. The patch attempts
to detect a failure before flushing the registers via rtsx_write_register.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rts5208/ms.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c
index f53adf15c685..04b588b8b376 100644
--- a/drivers/staging/rts5208/ms.c
+++ b/drivers/staging/rts5208/ms.c
@@ -2586,7 +2586,9 @@ void mspro_stop_seq_mode(struct rtsx_chip *chip)
 
ms_card->seq_mode = 0;
ms_card->total_sec_cnt = 0;
-   ms_send_cmd(chip, PRO_STOP, WAIT_INT);
+   retval = ms_send_cmd(chip, PRO_STOP, WAIT_INT);
+   if (retval != STATUS_SUCCESS)
+   return;
 
rtsx_write_register(chip, RBCTL, RB_FLUSH, RB_FLUSH);
}
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

[PATCH] rtl8723bs/ioctl_linux: Add a security check to copy_from_user()

[Aditya Pakki]

Currently, the return value of copy_from_user is not checked.
extra is assigned to u32wps_start irrespective of these failures.

Signed-off-by: Aditya Pakki 
---
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 9 +++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c 
b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index b8631baf128d..9992caa8c839 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2577,14 +2577,19 @@ static int rtw_wps_start(struct net_device *dev,
struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
struct iw_point *pdata = >data;
u32   u32wps_start = 0;
-unsigned int uintRet = 0;
 
if ((true == padapter->bDriverStopped) ||(true 
==padapter->bSurpriseRemoved) || (NULL == pdata)) {
ret = -EINVAL;
goto exit;
}
 
-   uintRet = copy_from_user((void*)_start, pdata->pointer, 4);
+   ret = copy_from_user((void *)_start, pdata->pointer, 4);
+
+   if (ret) {
+   ret = -EINVAL;
+   goto exit;
+   }
+
if (u32wps_start == 0)
u32wps_start = *extra;
 
-- 
2.17.1

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel