From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D15E1DDC23; Wed, 7 May 2025 18:50:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746643813; cv=none; b=V6hd8EnCk4VmvZM91P5TFFmnqYc+hfCJX00hO6s1FnJ57RPOWzoGlUuKNStWm1JtYZ13nA59+l2s93qO3F8Rpx7fO/Zcrt3os2SEIW1PxoMgBUoZ/tCJ6Bnfiec911b+qAVhRFnpJXkeYlZJQo/f8EKMtLYtfDa6OZZjIyzIHvg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746643813; c=relaxed/simple; bh=Xzrrb22u3DeCeXnw3TEukle/AjO5T5XKTIOmWZ6tMRs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lgy/9FcBcjtSsTd+jK8BxPuICvMJWkLzY3atluVlUFmdTo4SqpqtUVTrWV4wA03J4koLf3amPnsXUZc2oGYCU64yX2R5FiiD7LbEPojjcuh9jE92xTUalTzIBF2WK1hNScoMk3L18Si5gJXCFLXzmGF28uGDlWkctP+G1l3MKiY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Q9oV8Wd2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Q9oV8Wd2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3C95C4CEE2; Wed, 7 May 2025 18:50:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1746643813; bh=Xzrrb22u3DeCeXnw3TEukle/AjO5T5XKTIOmWZ6tMRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q9oV8Wd2TQ20QOwPxwFYU4NHH0OpVwd3KDbvtTAgRSaqZNUBXaKKSEioLqLImIlB6 TOOiISvUHpYg0OQFcKaTxW8k+OpkDly56VN8RW5MXTUVn6X0OgAfZpAdRA5OJODJm7 rKvjG0JI/grSulqI6C1trBtp5EoqQUd6Ab72zyog= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Wentao Liang , Arend van Spriel , Johannes Berg Subject: [PATCH 6.14 026/183] wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() Date: Wed, 7 May 2025 20:37:51 +0200 Message-ID: <20250507183825.745424442@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250507183824.682671926@linuxfoundation.org> References: <20250507183824.682671926@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Wentao Liang commit 8e089e7b585d95122c8122d732d1d5ef8f879396 upstream. The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but dose not check its return value. The 'state.state' and the 'state.bytes' are uninitialized if the function brcmf_usb_dl_cmd() fails. It is dangerous to use uninitialized variables in the conditions. Add error handling for brcmf_usb_dl_cmd() to jump to error handling path if the brcmf_usb_dl_cmd() fails and the 'state.state' and the 'state.bytes' are uninitialized. Improve the error message to report more detailed error information. Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") Cc: stable@vger.kernel.org # v3.4+ Signed-off-by: Wentao Liang Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250422042203.2259-1-vulab@iscas.ac.cn Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c @@ -896,14 +896,16 @@ brcmf_usb_dl_writeimage(struct brcmf_usb } /* 1) Prepare USB boot loader for runtime image */ - brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); + err = brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); + if (err) + goto fail; rdlstate = le32_to_cpu(state.state); rdlbytes = le32_to_cpu(state.bytes); /* 2) Check we are in the Waiting state */ if (rdlstate != DL_WAITING) { - brcmf_err("Failed to DL_START\n"); + brcmf_err("Invalid DL state: %u\n", rdlstate); err = -EINVAL; goto fail; }