linux-stable.git/drivers/staging/rtl8712, branch linux-5.11.y Linux kernel stable tree staging: rtl8712: Fix possible buffer overflow in r8712_sitesurvey_cmd 2021-03-17T16:11:39+00:00 Lee Gibson leegib@gmail.com 2021-03-01T13:26:48+00:00 1a1642a610394d27fb29255ab7e803b5b77b740c commit b93c1e3981af19527beee1c10a2bef67a228c48c upstream. Function r8712_sitesurvey_cmd calls memcpy without checking the length. A user could control that length and trigger a buffer overflow. Fix by checking the length is within the maximum allowed size. Signed-off-by: Lee Gibson <leegib@gmail.com> Link: https://lore.kernel.org/r/20210301132648.420296-1-leegib@gmail.com Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit b93c1e3981af19527beee1c10a2bef67a228c48c upstream.

Function r8712_sitesurvey_cmd calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.

Signed-off-by: Lee Gibson <leegib@gmail.com>
Link: https://lore.kernel.org/r/20210301132648.420296-1-leegib@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: unterminated string leads to read overflow 2021-03-17T16:11:39+00:00 Dan Carpenter dan.carpenter@oracle.com 2021-02-24T08:45:59+00:00 6e90e2392f26d2eb6c0ee2a5b3621a2debd641a1 commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream. The memdup_user() function does not necessarily return a NUL terminated string so this can lead to a read overflow. Switch from memdup_user() to strndup_user() to fix this bug. Fixes: c6dc001f2add ("staging: r8712u: Merging Realtek's latest (v2.6.6). Various fixes.") Cc: stable <stable@vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/YDYSR+1rj26NRhvb@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
commit d660f4f42ccea50262c6ee90c8e7ad19a69fb225 upstream.

The memdup_user() function does not necessarily return a NUL terminated
string so this can lead to a read overflow.  Switch from memdup_user()
to strndup_user() to fix this bug.

Fixes: c6dc001f2add ("staging: r8712u: Merging Realtek's latest (v2.6.6). Various fixes.")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YDYSR+1rj26NRhvb@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: Fix enqueue_reorder_recvframe() 2020-10-01T08:55:17+00:00 Dan Carpenter dan.carpenter@oracle.com 2020-09-29T10:35:48+00:00 29838144f280fc03ca06a621568f34e1d0a65a4f The logic of this function was accidentally broken by a checkpatch inspired cleanup. I've modified the code to restore the original behavior and also make checkpatch happy. Fixes: 98fe05e21a6e ("staging: rtl8712: Remove unnecesary else after return statement.") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20200929103548.GA493135@mwanda Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The logic of this function was accidentally broken by a checkpatch
inspired cleanup.  I've modified the code to restore the original
behavior and also make checkpatch happy.

Fixes: 98fe05e21a6e ("staging: rtl8712: Remove unnecesary else after return statement.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200929103548.GA493135@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: use shorter array initializations 2020-09-22T07:49:59+00:00 Michael Straube straube.linux@gmail.com 2020-09-19T08:50:32+00:00 4ed7f05244a2b51376e1351cdb08657f8d22ea82 Use empty brace syntax to initialize zero valued arrays. Simplifies and shortens the code a little bit. Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20200919085032.32453-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Use empty brace syntax to initialize zero valued arrays.
Simplifies and shortens the code a little bit.

Signed-off-by: Michael Straube <straube.linux@gmail.com>
Link: https://lore.kernel.org/r/20200919085032.32453-2-straube.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: clean up comparsions to NULL 2020-09-22T07:49:59+00:00 Michael Straube straube.linux@gmail.com 2020-09-19T08:50:31+00:00 0e934ce2904e05d80f79f7fcb08632df3d994b6b Clean up comparsions to NULL Reported by checkpatch. if (x == NULL) -> if (!x) if (x != NULL) -> if (x) Signed-off-by: Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20200919085032.32453-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Clean up comparsions to NULL Reported by checkpatch.
if (x == NULL) -> if (!x)
if (x != NULL) -> if (x)

Signed-off-by: Michael Straube <straube.linux@gmail.com>
Link: https://lore.kernel.org/r/20200919085032.32453-1-straube.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: convert tasklets to use new tasklet_setup() API 2020-09-16T11:13:00+00:00 Allen Pais apais@linux.microsoft.com 2020-09-16T06:18:31+00:00 1062aa9e99e6d9190327c86d8685140d621fc439 In preparation for unconditionally passing the struct tasklet_struct pointer to all tasklet callbacks, switch to using the new tasklet_setup() and from_tasklet() to pass the tasklet pointer explicitly. Signed-off-by: Romain Perier <romain.perier@gmail.com> Signed-off-by: Allen Pais <apais@linux.microsoft.com> Link: https://lore.kernel.org/r/20200916061831.57848-1-allen.lkml@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
In preparation for unconditionally passing the
struct tasklet_struct pointer to all tasklet
callbacks, switch to using the new tasklet_setup()
and from_tasklet() to pass the tasklet pointer explicitly.

Signed-off-by: Romain Perier <romain.perier@gmail.com>
Signed-off-by: Allen Pais <apais@linux.microsoft.com>
Link: https://lore.kernel.org/r/20200916061831.57848-1-allen.lkml@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Staging: rtl8712: Fixed a coding sytle issue 2020-07-29T12:00:25+00:00 Ankit Baluni b18007@students.iitmandi.ac.in 2020-07-29T07:45:41+00:00 341a8f866e7252e7c0410fdd53fe513a9c12f3d2 Removed braces for a 'if' condition as it contain only single line & there is no need for braces for such case according to coding style rules. Signed-off-by: Ankit Baluni <b18007@students.iitmandi.ac.in> Link: https://lore.kernel.org/r/20200729074541.1972-1-b18007@students.iitmandi.ac.in Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Removed braces for a 'if' condition as it contain only single line &
there is no need for braces for such case according to coding style
rules.

Signed-off-by: Ankit Baluni <b18007@students.iitmandi.ac.in>
Link: https://lore.kernel.org/r/20200729074541.1972-1-b18007@students.iitmandi.ac.in
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: Use fallthrough pseudo-keyword 2020-07-28T08:18:52+00:00 Gustavo A. R. Silva gustavoars@kernel.org 2020-07-27T18:58:38+00:00 8dda212c69c9a42d062b36fdf6dd09cf6d3cd392 Replace the existing /* fall through */ comments and its variants with the new pseudo-keyword macro fallthrough[1]. [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Link: https://lore.kernel.org/r/20200727185838.GA29595@embeddedor Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Replace the existing /* fall through */ comments and its variants with
the new pseudo-keyword macro fallthrough[1].

[1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20200727185838.GA29595@embeddedor
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl*/security: Use static const in array declarations 2020-07-17T10:08:44+00:00 Joe Perches joe@perches.com 2020-07-15T17:29:37+00:00 6cf2602159d2ac7e0494c1bbd164dd06bb2480ef Use static const in declarations where appropriate. Signed-off-by: Joe Perches <joe@perches.com> Link: https://lore.kernel.org/r/818bbd25924f0c733a4a39d426fd30392d4eae80.camel@perches.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
Use static const in declarations where appropriate.

Signed-off-by: Joe Perches <joe@perches.com>
Link: https://lore.kernel.org/r/818bbd25924f0c733a4a39d426fd30392d4eae80.camel@perches.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: rtl8712: handle firmware load failure 2020-07-17T10:08:44+00:00 Rustam Kovhaev rkovhaev@gmail.com 2020-07-16T15:13:26+00:00 b4383c971bc5263efe2b0915ba67ebf2bf3f1ee5 when firmware fails to load we should not call unregister_netdev() this patch fixes a race condition between rtl871x_load_fw_cb() and r871xu_dev_remove() and fixes the bug reported by syzbot Reported-by: syzbot+80899a8a8efe8968cde7@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=80899a8a8efe8968cde7 Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200716151324.1036204-1-rkovhaev@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
when firmware fails to load we should not call unregister_netdev()
this patch fixes a race condition between rtl871x_load_fw_cb() and
r871xu_dev_remove() and fixes the bug reported by syzbot

Reported-by: syzbot+80899a8a8efe8968cde7@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=80899a8a8efe8968cde7
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200716151324.1036204-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>