| Age | Commit message (Collapse) | Author |
|---|
|
Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in
race condition between r871xu_dev_remove() ->ndo_open() callback.
It's easy to see from crash log, that driver accesses released firmware
in ->ndo_open() callback. It may happen, since driver was releasing
firmware _before_ unregistering netdev. Fix it by moving
unregister_netdev() before cleaning up resources.
Call Trace:
...
rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]
rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170
rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394
netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380
__dev_open+0x2bc/0x4d0 net/core/dev.c:1484
Freed by task 1306:
...
release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053
r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599
usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458
Fixes: 8c213fa59199 ("staging: r8712u: Use asynchronous firmware loading")
Cc: stable <stable@vger.kernel.org>
Reported-and-tested-by: syzbot+c55162be492189fb4f51@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211019211718.26354-1-paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Commit 406f42fa0d3c ("net-next: When a bond have a massive amount
of VLANs...") introduced a rbtree for faster Ethernet address look
up. To maintain netdev->dev_addr in this tree we need to make all
the writes to it got through appropriate helpers.
Convert staging from ether_addr_copy() to eth_hw_addr_set():
@@
expression dev, np;
@@
- ether_addr_copy(dev->dev_addr, np)
+ eth_hw_addr_set(dev, np)
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Link: https://lore.kernel.org/r/20211019171243.1412240-3-kuba@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
There was strange error handling logic in case of fw load failure. For
some reason fw loader callback was doing clean up stuff when fw is not
available. I don't see any reason behind doing this. Since this driver
doesn't have EEPROM firmware let's just disconnect it in case of fw load
failure. Doing clean up stuff in 2 different place which can run
concurently is not good idea and syzbot found 2 bugs related to this
strange approach.
So, in this pacth I deleted all clean up code from fw callback and made
a call to device_release_driver() under device_lock(parent) in case of fw
load failure. This approach is more generic and it defend driver from UAF
bugs, since all clean up code is moved to one place.
Fixes: e02a3b945816 ("staging: rtl8712: fix memory leak in rtl871x_load_fw_cb")
Fixes: 8c213fa59199 ("staging: r8712u: Use asynchronous firmware loading")
Cc: stable <stable@vger.kernel.org>
Reported-and-tested-by: syzbot+5872a520e0ce0a7c7230@syzkaller.appspotmail.com
Reported-and-tested-by: syzbot+cc699626e48a6ebaf295@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/d49ecc56e97c4df181d7bd4d240b031f315eacc3.1626895918.git.paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch is preparation for following patch for error handling
refactoring.
flush_scheduled_work() takes (wq_completion)events lock and
it can lead to deadlock when r871xu_dev_remove() is called from workqueue.
To avoid deadlock sutiation we can change flush_scheduled_work() call to
flush_work() call for all possibly scheduled works in this driver,
since next patch adds device_release_driver() in case of fw load failure.
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/6e028b4c457eeb7156c76c6ea3cdb3cb0207c7e1.1626895918.git.paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Previous error handling path was unique for all
possible errors and there was unnecessary branching.
Also, one step for freeing drv_sw was missing. All
these problems was fixed by restructuring error
handling path.
Also, moved out free_netdev() from r8712_free_drv_sw() for
correct error handling.
Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/febb00f72354449bb4d305f373d6d2f47e539ab4.1623620630.git.paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
padapter->dvobj_init is initialized rigth before
initialization check. There is no need for any
branching here.
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/d367e5f39f22af44c545f8710cc18fb00f10e66c.1623620630.git.paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Following lines were fixed as dictated by running checkpatch
CHECK: Please don't use multiple blank lines
65: FILE: drivers/staging/rtl8712/xmit_linux.c:65:
+
CHECK: Blank lines aren't necessary after an open brace '{'
39: FILE: drivers/staging/rtl8712/usb_intf.c:39:
+static const struct usb_device_id rtl871x_usb_id_tbl[] = {
CHECK: Blank lines aren't necessary after an open brace '{'
849: FILE: drivers/staging/rtl8712/rtl871x_xmit.c:849:
+{
CHECK: Please don't use multiple blank lines
260: FILE: drivers/staging/rtl8712/rtl871x_sta_mgt.c:260:
+
Signed-off-by: Hriday Hegde <hridayhegde1999@gmail.com>
Link: https://lore.kernel.org/r/20210521153924.22843-1-hridayhegde1999@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Clean up comparsions to NULL Reported by checkpatch.
if (x == NULL) -> if (!x)
if (x != NULL) -> if (x)
Signed-off-by: Michael Straube <straube.linux@gmail.com>
Link: https://lore.kernel.org/r/20200919085032.32453-1-straube.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
when firmware fails to load we should not call unregister_netdev()
this patch fixes a race condition between rtl871x_load_fw_cb() and
r871xu_dev_remove() and fixes the bug reported by syzbot
Reported-by: syzbot+80899a8a8efe8968cde7@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=80899a8a8efe8968cde7
Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200716151324.1036204-1-rkovhaev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Make sure to use the current alternate setting when verifying the
interface descriptors to avoid binding to an invalid interface.
Failing to do so could cause the driver to misbehave or trigger a WARN()
in usb_submit_urb() that kernels with panic_on_warn set would choke on.
Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
Cc: stable <stable@vger.kernel.org> # 2.6.37
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191210114751.5119-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Change return values of init_drv_sw from _SUCCESS and _FAIL to 0 and
-ENOMEM. Change return type from u8 to int to allow this.
Add a return variable to streamline return of error codes of called
functions.
Modify call site to check for non-zero return value instead of _FAIL.
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
Link: https://lore.kernel.org/r/20190808064012.12661-7-nishkadg.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
In process of cleaning up struct _adapter in drv_types.h, lockRxFF0Filter
is renamed to to lock_rx_ff0_filter to fix a checkpatch reported issue.
Signed-off-by: Deepak Mishra <linux.dkm@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch renames CamelCase EepromAddressSizefrom to eeprom_address_size in
struct _adapter and in related files drv_types.h, rtl871x_eeprom.c, usb_intf.c
This was reported by checkpatch.pl
Signed-off-by: Deepak Mishra <linux.dkm@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
- Rename structure field bSuspended to suspended to avoid camelcase.
Suggested by checkpatch.
- Change type to bool as the variable is used as a boolean.
Signed-off-by: Himadri Pandya <himadri18.07@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
- Rename structure field bSurprisedRemoved to surprised_removed to avoid
camelcase. Suggested by checkpatch.
- Change type to bool as the variable is used as a boolean.
Signed-off-by: Himadri Pandya <himadri18.07@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
- Rename structure field bDriverStopped to driver_stopped to avoid
camelcase. Suggested by checkpatch.
- Change type to bool as the variable is being used as boolean.
Signed-off-by: Himadri Pandya <himadri18.07@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
When system resume and the rtl8712u dongle didn't lose its power, it
doesn't work quite right:
[ 146.844241] r8712u 2-3:1.0 wlp0s4f1u3: Unable to resume
...
[ 154.029573] r8712u 2-3:1.0 wlp0s4f1u3: In r8711_wx_set_scan: bDriverStopped=1
The !netif_running() check in PM callbacks aren't correct because
rtl8712u doesn't support runtime suspend, so the when the PM ops get
called, it's system suspend or system resume, hence we want to "stop
everthing" or "resume everything".
The NULL check on pnetdev is also redundant, the only place pnetdev can
become NULL is the disconnect callback, which is mutually exclusive to
PM callbacks.
This can make rtl8712u starts working after system resume.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
An USB wireless dongle uses rtl8712u stops working after system
suspend/resume.
When a USB device lost its power during suspend, the USB core knows the
power was lost and a reset-resume or a re-probe is required. But rtl8712u
provides a dummy reset-resume callback, which gets called and renders
the device dead after resume.
So remove the reset-resume call back, if power was lost during suspend,
let the USB core unbind and probe the device to solve the issue.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This satisfies a checkpatch warning and is the preferred
method for notating the license.
The SPDX identifier is a legally binding shorthand, which
can be used instead of the full boiler plate text.
Signed-off-by: Michael Straube <straube.linux@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix checkpath-reported unbalanced braces in the following areas
221: FILE: drivers/staging/rtl8712/hal_init.c:221:
392: FILE: drivers/staging/rtl8712/os_intfs.c:392:
363: FILE: drivers/staging/rtl8712/rtl8712_cmd.c:363:
889: FILE: drivers/staging/rtl8712/rtl8712_recv.c:889:
902: FILE: drivers/staging/rtl8712/rtl871x_cmd.c:902:
84: FILE: drivers/staging/rtl8712/rtl871x_ioctl_set.c:84:
580: FILE: drivers/staging/rtl8712/rtl871x_mlme.c:580:
593: FILE: drivers/staging/rtl8712/usb_intf.c:593:
Signed-off-by: Liam Ryan <liamryandev@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fixed a block comment indentation in the rtl8712 usb_intf.c file.
Signed-off-by: Gonçalo Salazar <glbsalazar@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix checkpatch.pl warning "Block comments use a trailing */ on
a separate line" on multiple files of the driver by editing the
affected comments.
Signed-off-by: Raphaël Beamonte <raphael.beamonte@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove exceptional '&' operator in front of a function name.
The Coccinelle semantic patch that is used to make this change is as
follows:
// <smpl>
@r@
identifier f;
@@
f(...) { ... }
@@
identifier r.f;
@@
- &f
+ f
@m@
type T;
identifier f;
@@
T f(...);
@@
identifier m.f;
@@
- &f
+ f
// </smpl>
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Declare rtl871x_intf_resume() function static since it is defined and called
in this file only.
This fixes the following sparse warning:
warning: symbol 'rtl871x_intf_resume' was not declared. Should it be static?
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Cancel pending URBs during suspend operation to avoid receiving ESHUTDOWN
in read/write completion callbacks while the device is suspended.
Receiving ESHUTDOWN in read/write completion callbacks will cause the
driver to enter a non-functioning "stopped" state from which the driver is
unable to recover without reloading the module.
Signed-off-by: Hemmo Nieminen <hemmo.nieminen@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Clean up all instances of checkpatch.pl checks:
CHECK: spaces preferred around that '+'
(and other operands)
Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix all instances of the following checkpatch.pl check:
CHECK: braces {} should be used on all arms of this statement
Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Boolean tests do not need explicit comparison to true or false.
Signed-off-by: Luis de Bethencourt <luisbg@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This adds the USB ID for the Sitecom WLA2100. The Windows 10 inf file
was checked to verify that the addition is correct.
Reported-by: Frans van de Wiel <fvdw@fvdw.eu>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Frans van de Wiel <fvdw@fvdw.eu>
Cc: Stable <stable@vger.kernel.org> [All stable versions]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
ARRAY_SIZE is more concise to use when the size of an array is divided
by the size of its type
Changes made using Coccinelle-
@@
type T;
T[] E;
@@
- (sizeof(E)/sizeof(T))
+ ARRAY_SIZE(E)
Signed-off-by: Shraddha Barke <shraddha.6596@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch fixes the following checkpatch.pl warning:
Prefer ether_addr_copy() over memcpy()
if the Ethernet addresses are __aligned(2)
pahole showed that the struct used pnetdev->dev_addr
is aligned to u16.
Moreover mac is a simple array, pdata is a pointer that
starts from an even offset.
Signed-off-by: Heba Aamer <heba93aamer@gmail.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch removes an unneeded call to printk.
Signed-off-by: Heba Aamer <heba93aamer@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
unused variables are removed. These variables were only assigned some
values and after that they were never being used. So they are safe to
be removed , and it has been build tested.
I left a call to r8712_read32(padapter, TCR) and
r8712_read8(padapter, SDIO_HCPWM) .
r8712_read32() and r8712_read8() is ultimately calling usb_read32()
and usb_read8() respectively. and they are again calling
r8712_usbctrl_vendorreq().
this r8712_usbctrl_vendorreq() is communicating through the usb bus
and is sending and receiving the control msg.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch delete explicit comparison to false and NULL in files of
rtl8712.
Signed-off-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch fixes checkpatch.pl warning in files of rtl8712
WARNING : line over 80 characters
Signed-off-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This patch fixes checkpatch.pl warning in files of rtl8712
WARNING : void function return statement are not generally useful
Signed-off-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The net device only exists when firmware is loaded successfully.
Firmware presence variable is only used through r871xu_dev_remove() and
this function already checks for net device existence.
Signed-off-by: Thomas Vegas <thomas@grouk.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
When firmware is not available, net device is not created. Upon
disconnect, we must check for net device existence before trying to
release net device private data.
Signed-off-by: Thomas Vegas <thomas@grouk.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
There is otherwise a risk of a possible null pointer dereference.
Was largely found by using a static code analysis program called cppcheck.
Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The latest version of NetworkManager does not recognize the device as wireless
without this change.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
There is a nice helper to parse MAC. Let's use it and remove custom
implementation.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Replace printk with netdev_printk helpers, dev_printk helpers or
pr_err/warn/info if there is no device info available.
Signed-off-by: Przemo Firszt <przemo@firszt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The ISY IWL 1000 USB WLAN stick with USB ID 050d:11f1 is a clone of
the Belkin F7D1101 V1 device.
Reported-by: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Thomas Hartmann <hartmann@ict.tuwien.ac.at>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This driver has a number of defines, etc. that are not used.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This picks up the staging changes made in 3.5-rc4 so that everyone can sync up
properly.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This driver contains version information that is outdated, has no real
value in terms of the Linux update process, and tends to confuse users.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
There are two new devices for this driver.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
In commit ee6aeff, a swatch warning was fixed by moving some code inside
an if block that is executed only when the pointer padapter is not NULL.
In fact, padapter can never be NULL and the corect fix should have been
the removal of the test of padapter.
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
