linux-stable.git/drivers/staging/rtl8192e, branch linux-3.16.y

staging: rtl8192e: fix potential use after free

2020-02-11T20:03:26+00:00

commit b7aa39a2ed0112d07fc277ebd24a08a7b2368ab9 upstream.

The variable skb is released via kfree_skb() when the return value of
_rtl92e_tx is not zero. However, after that, skb is accessed again to
read its length, which may result in a use after free bug. This patch
fixes the bug by moving the release operation to where skb is never
used later.

Signed-off-by: Pan Bian 
Reviewed-by: Dan Carpenter 
Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.

2017-09-15T17:29:36+00:00

commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.

EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl
will return invalid data so use rtl92e_readw.

The device is unable to select the right eeprom type.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: use read_nic_word()]
Signed-off-by: Ben Hutchings

staging: rtl8192e: fix 2 byte alignment of register BSSIDR.

2017-09-15T17:29:36+00:00

commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream.

BSSIDR has two byte alignment on PCI ioremap correct the write
by swapping to 16 bits first.

This fixes a problem that the device associates fail because
the filter is not set correctly.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: keep using write_nic_{word,dword}()]
Signed-off-by: Ben Hutchings

staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

2017-09-15T17:29:36+00:00

commit baabd567f87be05330faa5140f72a91960e7405a upstream.

The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: Malcolm Priestley 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

staging, rtl8192e, LLVMLinux: Remove unused inline prototype

2015-05-28T10:15:04+00:00

commit 62ec95f86d2850b7ce6d73fb236a6fcf48411aea upstream.

rtllib_probe_req is defined as "static inline" in rtllib_softmac.c however it
is declared differently as "extern inline" in rtllib_softmac.h. Since it isn't
used outside of the scope of rtllib_softmac, it makes sense to remove the
incorrect declaration.

Signed-off-by: Behan Webster 
Suggested-by: Arnd Bergmann 
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman 
Cc: Philip Müller 
Signed-off-by: Luis Henriques

staging, rtl8192e, LLVMLinux: Change extern inline to static inline

2015-05-28T10:13:18+00:00

commit 6d91857d4826b382b3fd4fad95f52713be646f96 upstream.

With compilers which follow the C99 standard (like modern versions of gcc and
clang), "extern inline" does the opposite thing from older versions of gcc
(emits code for an externally linkable version of the inline function).

"static inline" does the intended behavior in all cases instead.

Signed-off-by: Behan Webster 
Suggested-by: Arnd Bergmann 
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman 
Cc: Philip Müller 
Signed-off-by: Luis Henriques

Merge branch 'next' (accumulated 3.16 merge window patches) into master

2014-06-08T18:31:16+00:00

Now that 3.15 is released, this merges the 'next' branch into 'master',
bringing us to the normal situation where my 'master' branch is the
merge window.

* accumulated work in next: (6809 commits)
  ufs: sb mutex merge + mutex_destroy
  powerpc: update comments for generic idle conversion
  cris: update comments for generic idle conversion
  idle: remove cpu_idle() forward declarations
  nbd: zero from and len fields in NBD_CMD_DISCONNECT.
  mm: convert some level-less printks to pr_*
  MAINTAINERS: adi-buildroot-devel is moderated
  MAINTAINERS: add linux-api for review of API/ABI changes
  mm/kmemleak-test.c: use pr_fmt for logging
  fs/dlm/debug_fs.c: replace seq_printf by seq_puts
  fs/dlm/lockspace.c: convert simple_str to kstr
  fs/dlm/config.c: convert simple_str to kstr
  mm: mark remap_file_pages() syscall as deprecated
  mm: memcontrol: remove unnecessary memcg argument from soft limit functions
  mm: memcontrol: clean up memcg zoneinfo lookup
  mm/memblock.c: call kmemleak directly from memblock_(alloc|free)
  mm/mempool.c: update the kmemleak stack trace for mempool allocations
  lib/radix-tree.c: update the kmemleak stack trace for radix tree allocations
  mm: introduce kmemleak_update_trace()
  mm/kmemleak.c: use %u to print ->checksum
  ...

staging: r8192e_pci: fix htons error

2014-05-28T21:46:51+00:00

A sparse error fixup removed a htons() which is required for the driver
to function. This patch puts the htons() back and fixes the sparse
warning correctly by changing the left side cast.

Signed-off-by: Sean MacLennan 
Cc: stable  # 3.14
Signed-off-by: Greg Kroah-Hartman

drivers/staging: Remove useless return variables

2014-05-26T17:32:15+00:00

This patch remove variables that are initialized with a constant,
are never updated, and are only used as parameter of return.
Return the constant instead of using a variable.

Verified by compilation only.

The coccinelle script that find and fixes this issue is:
// 
@@
type T;
constant C;
identifier ret;
@@
- T ret = C;
... when != ret
    when strict
return
- ret
+ C
;
// 

Signed-off-by: Peter Senna Tschudin 
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: make return of 0 explicit

2014-05-23T17:14:30+00:00

Delete unnecessary use of a local variable to immediately return 0.

A simplified version of the semantic patch that fixes this problem is as
follows: (http://coccinelle.lip6.fr/)

// 
@r exists@
local idexpression ret;
expression e;
position p;
@@

-ret = 0;
... when != ret = e
return
- ret
+ 0
  ;
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman