- 19 May, 2022 40 commits
-
-
Dan Carpenter authored
These debugging tools let you call: status = usb_control_msg_recv/send(udev, 0, REALTEK_USB_VENQT_CMD_REQ, REALTEK_USB_VENQT_READ/WRITE, value, REALTEK_USB_VENQT_CMD_IDX, io_buf, size, RTW_USB_CONTROL_MSG_TIMEOUT, GFP_KERNEL); with a user controlled "value" in the 0-0xffff range. It's not a valid API. Fixes: 2b42bd58 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YoXS4OaD1oauPvmj@kiliSigned-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Soumya Negi authored
Conform to Linux coding style. Issue found by checkpatch:- CHECK: multiple assignments should be avoided Signed-off-by:
Soumya Negi <soumya.negi97@gmail.com> Link: https://lore.kernel.org/r/20220519095012.5619-1-soumya.negi97@gmail.comSigned-off-by:
-
Jiasheng Jiang authored
As kzalloc() may return null pointer, it should be better to check the return value and return error if fails in order to avoid dereference of null pointer. Moreover, the return value of rtw_alloc_hwxmits() should also be dealt with. Fixes: 15865124 ("staging: r8188eu: introduce new core dir for RTL8188eu driver") Reviewed-by:
Jiasheng Jiang <jiasheng@iscas.ac.cn> Link: https://lore.kernel.org/r/20220518075957.514603-1-jiasheng@iscas.ac.cnSigned-off-by:
-
Vihas Makwana authored
Refactor the code to fix following warnings: WARNING: Comparisons should place the constant on the right side of the test CHECK: Comparison to NULL could be written "p" Signed-off-by:Vihas Makwana <makvihas@gmail.com> Link: https://lore.kernel.org/r/20220517140626.3716-4-makvihas@gmail.comSigned-off-by:
-
Vihas Makwana authored
Refactor the code to fix following warnings: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by: -
Vihas Makwana authored
Refactor the code to fix following warning: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by: -
Wang Cheng authored
When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0, 'mac[6]' will not be initialized. BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x653/0x14b0 drivers/base/dd.c:596 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5358 [inline] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline] port_event drivers/usb/core/hub.c:5660 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307 worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454 kthread+0x3c7/0x500 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 Local variable mac created at: r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com> Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com> Reviewed-by:
Wang Cheng <wanngchenng@gmail.com> Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.comSigned-off-by:
-
Wang Cheng authored
When r8712_usbctrl_vendorreq() returns negative, 'data' in usb_read{8,16,32} will not be initialized. BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline] BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725 string_nocheck lib/vsprintf.c:643 [inline] string+0x4ec/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 va_format lib/vsprintf.c:1704 [inline] pointer+0x18e6/0x1f70 lib/vsprintf.c:2443 vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604 dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615 __dev_printk+0x3be/0x440 drivers/base/core.c:4627 _dev_info+0x1ea/0x22f drivers/base/core.c:4673 r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401 usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238 usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293 really_probe+0x6c7/0x1350 drivers/base/dd.c:621 __driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752 driver_probe_device drivers/base/dd.c:782 [inline] __device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899 bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427 __device_attach+0x593/0x8e0 drivers/base/dd.c:970 device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017 bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487 device_add+0x1fff/0x26e0 drivers/base/core.c:3405 usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566 hub_port_connect drivers/usb/core/hub.c:5363 [inline] hub_port_connect_change drivers/usb/core/hub.c:5507 [inline] port_event drivers/usb/core/hub.c:5665 [inline] hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747 process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289 worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436 kthread+0x3c7/0x500 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 Local variable data created at: usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33 r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29 KMSAN: uninit-value in r871xu_drv_init https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8 Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com> Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com> Reviewed-by: -
Wang Cheng authored
When 'status' returned from usb_control_msg() is not equal to 'len', that usb_control_msg() is on partial failure, r8712_usbctrl_vendorreq() will treat partial reads as success. Reviewed-by:
-
Phillip Potter authored
Remove the following defines: _drv_always_ _drv_emerg_ _drv_alert_ _drv_crit_ _drv_err_ _drv_warning_ _drv_notice_ _drv_info_ _drv_debug_ from include/rtw_debug.h, as they are no longer used anywhere in the driver, and are unlikely to be ever again with the removal of the old debugging/logging code. Signed-off-by:
Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/r/20220516224640.90973-1-phil@philpotter.co.ukSigned-off-by:
-
Gaston Gonzalez authored
BITSET_CLR is not used. Remove the define. Signed-off-by:
Gaston Gonzalez <gascoar@gmail.com> Link: https://lore.kernel.org/r/20220516221741.1015814-1-gascoar@gmail.comSigned-off-by:
-
Haowen Bai authored
container_of() will never return NULL, so remove useless code. Signed-off-by:
Haowen Bai <baihaowen@meizu.com> Link: https://lore.kernel.org/r/1652696533-18011-1-git-send-email-baihaowen@meizu.comSigned-off-by:
-
Haowen Bai authored
container_of() will never return NULL, so remove useless code. Signed-off-by:
-
Haowen Bai authored
container_of() will never return NULL, so remove useless code. Signed-off-by:
-
Michael Straube authored
Remove the HW_VAR_AC_PARAM_BE case from SetHwReg8188EU() and move the functionality to the place where SetHwReg8188EU() is called. This is part of the ongoing effort to get rid of the unwanted hal layer. Signed-off-by:
Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20220516054830.8702-1-straube.linux@gmail.comSigned-off-by:
-
Martin Kaiser authored
The assoc_rsp buffer in struct mlme_priv is not used. There's no need to store an incoming association response after receiving an processing it. Remove the buffer pointer and its length from struct mlme_priv. Signed-off-by:
Martin Kaiser <martin@kaiser.cx> Link: https://lore.kernel.org/r/20220515155401.352742-6-martin@kaiser.cxSigned-off-by:
-
Martin Kaiser authored
last_rx_mgnt_pkts in struct stainfo_stats is set but not used. Remove it. Signed-off-by:
-
Martin Kaiser authored
Simplify the error handling in recv_func_prehandle. There's no need to goto exit, this would be the next statement anyway. Signed-off-by:
-
Martin Kaiser authored
Remove some comments in HalPwrSeqCmd.c that contain no useful information. Signed-off-by:
-
Martin Kaiser authored
Use the ieee80211_is_beacon helper to check if the incoming frame is a beacon frame. Signed-off-by:
-
Martin Kaiser authored
Replace the numeric values with defines from ieee80211.h. Suggested-by:
Joe Perches <joe@perches.com> Signed-off-by:
-
Martin Kaiser authored
Extract the tid from the delba frame regardless of the recipient/initiator setting. Use the extracted tid when we process the delba frame. Signed-off-by:
-
Martin Kaiser authored
For an incoming delba message, the code checks if the delba was sent by the data initiator or by the data recipient. Rewrite this check using the ieee80211 helpers, making the code easier to understand. Signed-off-by:
-
Martin Kaiser authored
Use BIT(tid) instead of 1 << tid when we process an addba response. Signed-off-by:
-
Martin Kaiser authored
Replace an if statement with a ternary operator, making the code a tiny bit shorter. Signed-off-by:
-
Martin Kaiser authored
The process_addba_req function is called only by OnAction_back. Merge the two functions. OnAction_back has already checked that psta != NULL, we can drop the check in process_addba_req before merging the functions. We can also simplify the parsing of the tid by using struct ieee80211. Signed-off-by:
-
Martin Kaiser authored
Use the same code as ieee80211_process_addba_resp to calculate the tid from the capability field of an addba response message. Signed-off-by:
-
Martin Kaiser authored
Read the addba response status from struct ieee80211_mgmt instead of parsing the incoming frame ourselves. Signed-off-by:
-
Soumya Negi authored
Adhere to Linux coding style. Fix the below checkpatch warning: WARNING: Block comments should align the * on each line Signed-off-by:
-
Soumya Negi authored
Adhere to Linux coding style. Fixes checkpatch warnings: CHECK: Alignment should match open parenthesis CHECK: line length of 101 exceeds 100 columns Signed-off-by:
-
Philipp Hortmann authored
Replace macro VNSvOutPortB with iowrite8 because it replaces just one line. The name of macro and the arguments use CamelCase which is not accepted by checkpatch.pl Signed-off-by:
Philipp Hortmann <philipp.g.hortmann@gmail.com> Link: https://lore.kernel.org/r/38611512677a18f63d9266cde1d20758c0feeb6e.1651957741.git.philipp.g.hortmann@gmail.comSigned-off-by:
-
Philipp Hortmann authored
Replace macro MACvTransmitBCN with VNSvOutPortB and as it was the only user, it can now be removed. Signed-off-by:
-
Philipp Hortmann authored
Replace macro MACvStart with VNSvOutPortB and as it was the only user, it can now be removed. Signed-off-by:
-
Vihas Makwana authored
The check for ETH_P_IP is already performed in the outer if block and inner if check is redundant. So drop the check. Signed-off-by:
-
Martin Kaiser authored
Read the back action code from struct ieee80211_mgmt. struct ieee80211_mgmt contains an "action" union. Each of its members starts with an 8-bit action code. Treat the union as addba_req when we read the action code although we do not yet know if it is an addba_req. This approach is similar to ieee80211_iface_process_skb. Signed-off-by:
-
Martin Kaiser authored
Use the defines from ieee80211.h for the back action codes. Signed-off-by:
-
Martin Kaiser authored
For management frames, addr1 is the destination address (da). Read this address from struct ieee80211_mgmt instead of calling a driver-specific macro. Signed-off-by:
-
Martin Kaiser authored
Do not check the category in OnAction_back. OnAction has already checked the category before calling OnAction_back. Signed-off-by:
-
Martin Kaiser authored
Define a struct ieee80211_mgmt variable in the OnAction_back function. Use it to read addr2. For management frames, addr2 is the source address (sa). Signed-off-by:
-
Colin Ian King authored
Don't populate the const array queuetopipe on the stack, instead make it static. Also makes the object code smaller. Signed-off-by:
Colin Ian King <colin.i.king@gmail.com> Link: https://lore.kernel.org/r/20220507183414.26633-1-colin.i.king@gmail.comSigned-off-by:
-
