1. 04 Nov, 2022 6 commits
    • Jisoo Jang's avatar
      wifi: brcmfmac: Fix potential NULL pointer dereference in 'brcmf_c_preinit_dcmds()' · 683b9728
      Jisoo Jang authored
      This patch fixes a NULL pointer dereference bug in brcmfmac that occurs
      when ptr which is NULL pointer passed as an argument of strlcpy() in
      brcmf_c_preinit_dcmds(). This happens when the driver passes a firmware
      version string that does not contain a space " ", making strrchr()
      return a null pointer. This patch adds a null pointer check.
      
      Found by a modified version of syzkaller.
      
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 0 PID: 1983 Comm: kworker/0:2 Not tainted 5.14.0+ #79
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
      rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      Workqueue: usb_hub_wq hub_event
      RIP: 0010:strlen+0x1a/0x90
      Code: 23 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 48 b8 00 00 00 00
      00 fc ff df 48 89 fa 55 48 89 fd 48 c1 ea 03 53 48 83 ec 08 <0f> b6 04
      02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 48 80 7d 00 00
      RSP: 0018:ffffc90002bfedd8 EFLAGS: 00010296
      RAX: dffffc0000000000 RBX: 1ffff9200057fdc1 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000001
      RBP: 0000000000000001 R08: 0000000000000039 R09: ffffed1023549801
      R10: ffff88811aa4c007 R11: ffffed1023549800 R12: ffff88800bc68d6c
      R13: ffffc90002bfef08 R14: ffff88800bc6bc7c R15: 0000000000000001
      FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020546180 CR3: 0000000117ff1000 CR4: 0000000000750ef0
      PKRU: 55555554
      Call Trace:
       brcmf_c_preinit_dcmds+0x9f2/0xc40
       ? brcmf_c_set_joinpref_default+0x100/0x100
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lock_acquire+0x19d/0x4e0
       ? find_held_lock+0x2d/0x110
       ? brcmf_usb_deq+0x1a7/0x260
       ? brcmf_usb_rx_fill_all+0x5a/0xf0
       brcmf_attach+0x246/0xd40
       ? wiphy_new_nm+0x1703/0x1dd0
       ? kmemdup+0x43/0x50
       brcmf_usb_probe+0x12de/0x1690
       ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
       usb_probe_interface+0x2aa/0x760
       ? usb_probe_device+0x250/0x250
       really_probe+0x205/0xb70
       ? driver_allows_async_probing+0x130/0x130
       __driver_probe_device+0x311/0x4b0
       ? driver_allows_async_probing+0x130/0x130
       driver_probe_device+0x4e/0x150
       __device_attach_driver+0x1cc/0x2a0
       bus_for_each_drv+0x156/0x1d0
       ? bus_rescan_devices+0x30/0x30
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x46/0x160
       __device_attach+0x23f/0x3a0
       ? device_bind_driver+0xd0/0xd0
       ? kobject_uevent_env+0x287/0x14b0
       bus_probe_device+0x1da/0x290
       device_add+0xb7b/0x1eb0
       ? wait_for_completion+0x290/0x290
       ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
       usb_set_configuration+0xf59/0x16f0
       usb_generic_driver_probe+0x82/0xa0
       usb_probe_device+0xbb/0x250
       ? usb_suspend+0x590/0x590
       really_probe+0x205/0xb70
       ? driver_allows_async_probing+0x130/0x130
       __driver_probe_device+0x311/0x4b0
       ? usb_generic_driver_match+0x75/0x90
       ? driver_allows_async_probing+0x130/0x130
       driver_probe_device+0x4e/0x150
       __device_attach_driver+0x1cc/0x2a0
       bus_for_each_drv+0x156/0x1d0
       ? bus_rescan_devices+0x30/0x30
       ? _raw_spin_unlock_irqrestore+0x47/0x50
       __device_attach+0x23f/0x3a0
       ? device_bind_driver+0xd0/0xd0
       ? kobject_uevent_env+0x287/0x14b0
       bus_probe_device+0x1da/0x290
       device_add+0xb7b/0x1eb0
       ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0
       ? kfree+0x14a/0x6b0
       ? __usb_get_extra_descriptor+0x116/0x160
       usb_new_device.cold+0x49c/0x1029
       ? hub_disconnect+0x450/0x450
       ? rwlock_bug.part.0+0x90/0x90
       ? _raw_spin_unlock_irq+0x24/0x30
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       hub_event+0x248b/0x31c9
       ? usb_port_suspend.cold+0x139/0x139
       ? check_irq_usage+0x861/0xf20
       ? drain_workqueue+0x280/0x360
       ? lock_release+0x640/0x640
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       process_one_work+0x92b/0x1460
       ? pwq_dec_nr_in_flight+0x330/0x330
       ? rwlock_bug.part.0+0x90/0x90
       worker_thread+0x95/0xe00
       ? __kthread_parkme+0x115/0x1e0
       ? process_one_work+0x1460/0x1460
       kthread+0x3a1/0x480
       ? set_kthread_struct+0x120/0x120
       ret_from_fork+0x1f/0x30
      Modulesdd linked in:
      ---[ end trace c112c68924ddd800 ]---
      RIP: 0010:strlen+0x1a/0x90
      Code: 23 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 90 48 b8 00 00 00 00
      00 fc ff df 48 89 fa 55 48 89 fd 48 c1 ea 03 53 48 83 ec 08 <0f> b6 04
      02 48 89 fa 83 e2 07 38 d0 7f 04 84 c0 75 48 80 7d 00 00
      RSP: 0018:ffffc90002bfedd8 EFLAGS: 00010296
      RAX: dffffc0000000000 RBX: 1ffff9200057fdc1 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000020 RDI: 0000000000000001
      RBP: 0000000000000001 R08: 0000000000000039 R09: ffffed1023549801
      R10: ffff88811aa4c007 R11: ffffed1023549800 R12: ffff88800bc68d6c
      R13: ffffc90002bfef08 R14: ffff88800bc6bc7c R15: 0000000000000001
      FS:  0000000000000000(0000) GS:ffff88811aa00000(0000)
      knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020546180 CR3: 0000000117ff1000 CR4: 0000000000750ef0
      PKRU: 55555554
      Kernel panic - not syncing: Fatal exception
      Kernel Offset: disabled
      Reported-by: default avatarDokyung Song <dokyungs@yonsei.ac.kr>
      Reported-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Reported-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221101183642.166450-1-jisoo.jang@yonsei.ac.kr
      683b9728
    • Jonathan Neuschäfer's avatar
    • Colin Ian King's avatar
      wifi: rtlwifi: rtl8192ee: remove static variable stop_report_cnt · cdeee854
      Colin Ian King authored
      Variable stop_report_cnt is being set or incremented but is never
      being used for anything meaningful. The variable and code relating
      to it's use is redundant and can be removed.
      Signed-off-by: default avatarColin Ian King <colin.i.king@gmail.com>
      Acked-by: default avatarPing-Ke Shih <pkshih@realtek.com>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221031155637.871164-1-colin.i.king@gmail.com
      cdeee854
    • Linus Walleij's avatar
      bcma: Fail probe if GPIO subdriver fails · 74a47300
      Linus Walleij authored
      We currently register the BCMA core even if the GPIO portions
      fail. There is no reason for this: the GPIO should register
      just fine, if it fails the BCMA driver should fail.
      
      We already gracefully handle the case where the GPIO driver is
      not compiled in.
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221028093000.239020-1-linus.walleij@linaro.org
      74a47300
    • Linus Walleij's avatar
      bcma: Use the proper gpio include · 2b6c0e15
      Linus Walleij authored
      The <linux/bcma/bcma_driver_chipcommon.h> is including the legacy
      header <linux/gpio.h> to obtain struct gpio_chip. Instead, include
      <linux/gpio/driver.h> where this struct is defined.
      
      It turns out that the brcm80211 brcmsmac depends on this to
      bring in the symbol gpio_is_valid().
      
      The driver looks up the BCMA parent GPIO driver and checks that
      this succeeds, but then it goes on to use the deprecated GPIO
      call gpio_is_valid() to check the consistency of the .base
      member of the BCMA GPIO struct. The whole check can be dropped
      because the bcma_gpio is initialized in the declarations:
      
        struct gpio_chip *bcma_gpio = &cc_drv->gpio;
      
      And this can never be NULL.
      
      Cc: Jonas Gorski <jonas.gorski@gmail.com>
      Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
      Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221028092332.238728-1-linus.walleij@linaro.org
      2b6c0e15
    • Minsuk Kang's avatar
      wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() · 81d17f6f
      Minsuk Kang authored
      This patch fixes a shift-out-of-bounds in brcmfmac that occurs in
      BIT(chiprev) when a 'chiprev' provided by the device is too large.
      It should also not be equal to or greater than BITS_PER_TYPE(u32)
      as we do bitwise AND with a u32 variable and BIT(chiprev). The patch
      adds a check that makes the function return NULL if that is the case.
      Note that the NULL case is later handled by the bus-specific caller,
      brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example.
      
      Found by a modified version of syzkaller.
      
      UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
      shift exponent 151055786 is too large for 64-bit type 'long unsigned int'
      CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
      Workqueue: usb_hub_wq hub_event
      Call Trace:
       dump_stack_lvl+0x57/0x7d
       ubsan_epilogue+0x5/0x40
       __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb
       ? lock_chain_count+0x20/0x20
       brcmf_fw_alloc_request.cold+0x19/0x3ea
       ? brcmf_fw_get_firmwares+0x250/0x250
       ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0
       brcmf_usb_get_fwname+0x114/0x1a0
       ? brcmf_usb_reset_resume+0x120/0x120
       ? number+0x6c4/0x9a0
       brcmf_c_process_clm_blob+0x168/0x590
       ? put_dec+0x90/0x90
       ? enable_ptr_key_workfn+0x20/0x20
       ? brcmf_common_pd_remove+0x50/0x50
       ? rcu_read_lock_sched_held+0xa1/0xd0
       brcmf_c_preinit_dcmds+0x673/0xc40
       ? brcmf_c_set_joinpref_default+0x100/0x100
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lock_acquire+0x19d/0x4e0
       ? find_held_lock+0x2d/0x110
       ? brcmf_usb_deq+0x1cc/0x260
       ? mark_held_locks+0x9f/0xe0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? _raw_spin_unlock_irqrestore+0x47/0x50
       ? trace_hardirqs_on+0x1c/0x120
       ? brcmf_usb_deq+0x1a7/0x260
       ? brcmf_usb_rx_fill_all+0x5a/0xf0
       brcmf_attach+0x246/0xd40
       ? wiphy_new_nm+0x1476/0x1d50
       ? kmemdup+0x30/0x40
       brcmf_usb_probe+0x12de/0x1690
       ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
       usb_probe_interface+0x25f/0x710
       really_probe+0x1be/0xa90
       __driver_probe_device+0x2ab/0x460
       ? usb_match_id.part.0+0x88/0xc0
       driver_probe_device+0x49/0x120
       __device_attach_driver+0x18a/0x250
       ? driver_allows_async_probing+0x120/0x120
       bus_for_each_drv+0x123/0x1a0
       ? bus_rescan_devices+0x20/0x20
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x1c/0x120
       __device_attach+0x207/0x330
       ? device_bind_driver+0xb0/0xb0
       ? kobject_uevent_env+0x230/0x12c0
       bus_probe_device+0x1a2/0x260
       device_add+0xa61/0x1ce0
       ? __mutex_unlock_slowpath+0xe7/0x660
       ? __fw_devlink_link_to_suppliers+0x550/0x550
       usb_set_configuration+0x984/0x1770
       ? kernfs_create_link+0x175/0x230
       usb_generic_driver_probe+0x69/0x90
       usb_probe_device+0x9c/0x220
       really_probe+0x1be/0xa90
       __driver_probe_device+0x2ab/0x460
       driver_probe_device+0x49/0x120
       __device_attach_driver+0x18a/0x250
       ? driver_allows_async_probing+0x120/0x120
       bus_for_each_drv+0x123/0x1a0
       ? bus_rescan_devices+0x20/0x20
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       ? trace_hardirqs_on+0x1c/0x120
       __device_attach+0x207/0x330
       ? device_bind_driver+0xb0/0xb0
       ? kobject_uevent_env+0x230/0x12c0
       bus_probe_device+0x1a2/0x260
       device_add+0xa61/0x1ce0
       ? __fw_devlink_link_to_suppliers+0x550/0x550
       usb_new_device.cold+0x463/0xf66
       ? hub_disconnect+0x400/0x400
       ? _raw_spin_unlock_irq+0x24/0x30
       hub_event+0x10d5/0x3330
       ? hub_port_debounce+0x280/0x280
       ? __lock_acquire+0x1671/0x5790
       ? wq_calc_node_cpumask+0x170/0x2a0
       ? lock_release+0x640/0x640
       ? rcu_read_lock_sched_held+0xa1/0xd0
       ? rcu_read_lock_bh_held+0xb0/0xb0
       ? lockdep_hardirqs_on_prepare+0x273/0x3e0
       process_one_work+0x873/0x13e0
       ? lock_release+0x640/0x640
       ? pwq_dec_nr_in_flight+0x320/0x320
       ? rwlock_bug.part.0+0x90/0x90
       worker_thread+0x8b/0xd10
       ? __kthread_parkme+0xd9/0x1d0
       ? process_one_work+0x13e0/0x13e0
       kthread+0x379/0x450
       ? _raw_spin_unlock_irq+0x24/0x30
       ? set_kthread_struct+0x100/0x100
       ret_from_fork+0x1f/0x30
      Reported-by: default avatarDokyung Song <dokyungs@yonsei.ac.kr>
      Reported-by: default avatarJisoo Jang <jisoo.jang@yonsei.ac.kr>
      Reported-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarMinsuk Kang <linuxlovemin@yonsei.ac.kr>
      Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
      Link: https://lore.kernel.org/r/20221024071329.504277-1-linuxlovemin@yonsei.ac.kr
      81d17f6f
  2. 01 Nov, 2022 16 commits
  3. 29 Oct, 2022 18 commits