Commit 3d6b77a8 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are three small staging driver fixes for 6.5-rc4 that resolve
  some reported problems. These fixes are:

   - fix for an old bug in the r8712 driver

   - fbtft driver fix for a spi device

   - potential overflow fix in the ks7010 driver

  All of these have been in linux-next with no reported problems"

* tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
  staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER
  staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
parents cf270e7b 5f1c7031
......@@ -145,7 +145,7 @@ static struct fbtft_display display = {
},
};
FBTFT_REGISTER_DRIVER(DRVNAME, "ilitek,ili9341", &display);
FBTFT_REGISTER_SPI_DRIVER(DRVNAME, "ilitek", "ili9341", &display);
MODULE_ALIAS("spi:" DRVNAME);
MODULE_ALIAS("platform:" DRVNAME);
......
......@@ -1583,8 +1583,10 @@ static int ks_wlan_set_encode_ext(struct net_device *dev,
commit |= SME_WEP_FLAG;
}
if (enc->key_len) {
memcpy(&key->key_val[0], &enc->key[0], enc->key_len);
key->key_len = enc->key_len;
int key_len = clamp_val(enc->key_len, 0, IW_ENCODING_TOKEN_MAX);
memcpy(&key->key_val[0], &enc->key[0], key_len);
key->key_len = key_len;
commit |= (SME_WEP_VAL1 << index);
}
break;
......
......@@ -21,6 +21,7 @@
#include "osdep_intf.h"
#include "usb_ops.h"
#include <linux/usb.h>
#include <linux/ieee80211.h>
static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8};
......@@ -55,6 +56,7 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
sint i;
struct xmit_buf *pxmitbuf;
struct xmit_frame *pxframe;
int j;
memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
spin_lock_init(&pxmitpriv->lock);
......@@ -117,11 +119,8 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
_init_queue(&pxmitpriv->pending_xmitbuf_queue);
pxmitpriv->pallocated_xmitbuf =
kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC);
if (!pxmitpriv->pallocated_xmitbuf) {
kfree(pxmitpriv->pallocated_frame_buf);
pxmitpriv->pallocated_frame_buf = NULL;
return -ENOMEM;
}
if (!pxmitpriv->pallocated_xmitbuf)
goto clean_up_frame_buf;
pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3);
pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
......@@ -129,13 +128,17 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
INIT_LIST_HEAD(&pxmitbuf->list);
pxmitbuf->pallocated_buf =
kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC);
if (!pxmitbuf->pallocated_buf)
return -ENOMEM;
if (!pxmitbuf->pallocated_buf) {
j = 0;
goto clean_up_alloc_buf;
}
pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -
((addr_t) (pxmitbuf->pallocated_buf) &
(XMITBUF_ALIGN_SZ - 1));
if (r8712_xmit_resource_alloc(padapter, pxmitbuf))
return -ENOMEM;
if (r8712_xmit_resource_alloc(padapter, pxmitbuf)) {
j = 1;
goto clean_up_alloc_buf;
}
list_add_tail(&pxmitbuf->list,
&(pxmitpriv->free_xmitbuf_queue.queue));
pxmitbuf++;
......@@ -146,6 +149,28 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
tasklet_setup(&pxmitpriv->xmit_tasklet, r8712_xmit_bh);
return 0;
clean_up_alloc_buf:
if (j) {
/* failure happened in r8712_xmit_resource_alloc()
* delete extra pxmitbuf->pallocated_buf
*/
kfree(pxmitbuf->pallocated_buf);
}
for (j = 0; j < i; j++) {
int k;
pxmitbuf--; /* reset pointer */
kfree(pxmitbuf->pallocated_buf);
for (k = 0; k < 8; k++) /* delete xmit urb's */
usb_free_urb(pxmitbuf->pxmit_urb[k]);
}
kfree(pxmitpriv->pallocated_xmitbuf);
pxmitpriv->pallocated_xmitbuf = NULL;
clean_up_frame_buf:
kfree(pxmitpriv->pallocated_frame_buf);
pxmitpriv->pallocated_frame_buf = NULL;
return -ENOMEM;
}
void _free_xmit_priv(struct xmit_priv *pxmitpriv)
......
......@@ -112,6 +112,12 @@ int r8712_xmit_resource_alloc(struct _adapter *padapter,
for (i = 0; i < 8; i++) {
pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
if (!pxmitbuf->pxmit_urb[i]) {
int k;
for (k = i - 1; k >= 0; k--) {
/* handle allocation errors part way through loop */
usb_free_urb(pxmitbuf->pxmit_urb[k]);
}
netdev_err(padapter->pnetdev, "pxmitbuf->pxmit_urb[i] == NULL\n");
return -ENOMEM;
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment