linux.git/drivers/staging, branch v5.6-rc4

staging: rtl8723bs: Remove unneeded goto statements

2020-02-10T18:32:38+00:00

In routines rtw_hostapd_ioctl() and wpa_supplicant_ioctl(), several
error conditions involve setting a variable indicating the error,
followed by a goto. The code following the target of that goto merely
returns the value. It is simpler, therefore to return the error value
immediately, and eliminate the got  target.

Signed-off-by: Larry Finger 
Cc: Pietro Oliva 
Link: https://lore.kernel.org/r/20200210180235.21691-7-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: rtl8188eu: Remove some unneeded goto statements

2020-02-10T18:32:38+00:00

In routines rtw_hostapd_ioctl() and wpa_supplicant_ioctl(), several
error conditions involve setting a variable indicating the error,
followed by a goto. The code following the target of that goto merely
returns the value. It is simpler, therefore to return the error value
immediately, and eliminate the got  target.

Signed-off-by: Larry Finger 
Cc: Pietro Oliva 
Link: https://lore.kernel.org/r/20200210180235.21691-6-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Fix potential overuse of kernel memory

2020-02-10T18:32:38+00:00

In routine wpa_supplicant_ioctl(), the user-controlled p->length is
checked to be at least the size of struct ieee_param size, but the code
does not detect the case where p->length is greater than the size
of the struct, thus a malicious user could be wasting kernel memory.
Fixes commit 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").

Reported by: Pietro Oliva 
Cc: Pietro Oliva 
Cc: Stable 
Fixes: 554c0a3abf216 ("staging: Add rtl8723bs sdio wifi driver").
Signed-off-by: Larry Finger 
Link: https://lore.kernel.org/r/20200210180235.21691-5-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: rtl8188eu: Fix potential overuse of kernel memory

2020-02-10T18:32:38+00:00

In routine wpa_supplicant_ioctl(), the user-controlled p->length is
checked to be at least the size of struct ieee_param size, but the code
does not detect the case where p->length is greater than the size
of the struct, thus a malicious user could be wasting kernel memory.
Fixes commit a2c60d42d97c ("Add files for new driver - part 16").

Reported by: Pietro Oliva 
Cc: Pietro Oliva 
Cc: Stable 
Fixes commit a2c60d42d97c ("Add files for new driver - part 16").
Signed-off-by: Larry Finger 
Link: https://lore.kernel.org/r/20200210180235.21691-4-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: Fix potential security hole

2020-02-10T18:32:38+00:00

In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed
to be at least the size of struct ieee_param size, but this assumption is
never checked. This could result in out-of-bounds read/write on kernel
heap in case a p->length less than the size of struct ieee_param is
specified by the user. If p->length is allowed to be greater than the size
of the struct, then a malicious user could be wasting kernel memory.
Fixes commit 554c0a3abf216 ("0taging: Add rtl8723bs sdio wifi driver").

Reported by: Pietro Oliva 
Cc: Pietro Oliva 
Cc: Stable 
Fixes 554c0a3abf216 ("0taging: Add rtl8723bs sdio wifi driver").
Signed-off-by: Larry Finger 
Link: https://lore.kernel.org/r/20200210180235.21691-3-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: rtl8188eu: Fix potential security hole

2020-02-10T18:32:31+00:00

In routine rtw_hostapd_ioctl(), the user-controlled p->length is assumed
to be at least the size of struct ieee_param size, but this assumption is
never checked. This could result in out-of-bounds read/write on kernel
heap in case a p->length less than the size of struct ieee_param is
specified by the user. If p->length is allowed to be greater than the size
of the struct, then a malicious user could be wasting kernel memory.
Fixes commit a2c60d42d97c ("Add files for new driver - part 16").

Reported by: Pietro Oliva 
Cc: Pietro Oliva 
Cc: Stable 
Fixes: a2c60d42d97c ("staging: r8188eu: Add files for new driver - part 16")
Signed-off-by: Larry Finger 
Link: https://lore.kernel.org/r/20200210180235.21691-2-Larry.Finger@lwfinger.net
Signed-off-by: Greg Kroah-Hartman

staging: greybus: use after free in gb_audio_manager_remove_all()

2020-02-10T16:52:33+00:00

When we call kobject_put() and it's the last reference to the kobject
then it calls gb_audio_module_release() and frees module.  We dereference
"module" on the next line which is a use after free.

Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
Signed-off-by: Dan Carpenter 
Acked-by: Viresh Kumar 
Reviewed-by: Vaibhav Agarwal 
Link: https://lore.kernel.org/r/20200205123217.jreendkyxulqsool@kili.mountain
Signed-off-by: Greg Kroah-Hartman

staging: android: Delete the 'vsoc' driver

2020-02-10T16:51:12+00:00

The 'vsoc' driver was required for an early iteration of the Android
'cuttlefish' virtual platform, but this platform has been wholly
converted to use virtio drivers instead. Delete this old driver.

Cc: Greg Kroah-Hartman 
Cc: Joel Fernandes 
Cc: Greg Hartman 
Cc: kernel-team@android.com
Cc: devel@driverdev.osuosl.org
Signed-off-by: Alistair Delva 
Reviewed-by: Joel Fernandes (Google) 
Link: https://lore.kernel.org/r/20200203042254.80360-1-adelva@google.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8723bs: fix copy of overlapping memory

2020-02-10T16:49:11+00:00

Currently the rtw_sprintf prints the contents of thread_name
onto thread_name and this can lead to a potential copy of a
string over itself. Avoid this by printing the literal string RTWHALXT
instread of the contents of thread_name.

Addresses-Coverity: ("copy of overlapping memory")
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Colin Ian King 
Reviewed-by: Hans de Goede 
Link: https://lore.kernel.org/r/20200126220549.9849-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: Disallow ashmem memory from being remapped

2020-02-10T16:49:11+00:00

When ashmem file is mmapped, the resulting vma->vm_file points to the
backing shmem file with the generic fops that do not check ashmem
permissions like fops of ashmem do. If an mremap is done on the ashmem
region, then the permission checks will be skipped. Fix that by disallowing
mapping operation on the backing shmem file.

Reported-by: Jann Horn 
Signed-off-by: Suren Baghdasaryan 
Cc: stable  # 4.4,4.9,4.14,4.18,5.4
Signed-off-by: Todd Kjos 
Reviewed-by: Joel Fernandes (Google) 
Link: https://lore.kernel.org/r/20200127235616.48920-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman