* [PATCH AUTOSEL 5.15 02/51] staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
[not found] <20220607175552.479948-1-sashal@kernel.org>
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 05/51] drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() Sasha Levin
` (6 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Xiaoke Wang, Dan Carpenter, Greg Kroah-Hartman, Sasha Levin,
Larry.Finger, florian.c.schilhabel, kuba, paskripkin, len.baker,
skumark1902, wanngchenng, linux-staging
From: Xiaoke Wang <xkernel.wang@foxmail.com>
[ Upstream commit 7288ff561de650d4139fab80e9cb0da9b5b32434 ]
In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
properly released as there is no action will be performed by
r8712_usb_dvobj_deinit().
To properly release it, we should call r8712_free_io_queue() in
r8712_usb_dvobj_deinit().
Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
by r871x_dev_unload() under condition `padapter->bup` and
r8712_free_io_queue() is called by r8712_free_drv_sw().
However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
better understading the code.
So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
r8712_free_io_queue() from r8712_free_drv_sw().
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com>
Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8712/os_intfs.c | 1 -
drivers/staging/rtl8712/usb_intf.c | 6 +++---
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
index 9502f6aa5306..bc033849fcea 100644
--- a/drivers/staging/rtl8712/os_intfs.c
+++ b/drivers/staging/rtl8712/os_intfs.c
@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
r8712_free_evt_priv(&padapter->evtpriv);
r8712_DeInitSwLeds(padapter);
r8712_free_mlme_priv(&padapter->mlmepriv);
- r8712_free_io_queue(padapter);
_free_xmit_priv(&padapter->xmitpriv);
_r8712_free_sta_priv(&padapter->stapriv);
_r8712_free_recv_priv(&padapter->recvpriv);
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index cae04272deff..a61dd96ab2a4 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
{
+ r8712_free_io_queue(padapter);
}
void rtl871x_intf_stop(struct _adapter *padapter)
@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)
rtl8712_hal_deinit(padapter);
}
- /*s6.*/
- if (padapter->dvobj_deinit)
- padapter->dvobj_deinit(padapter);
padapter->bup = false;
}
}
@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
/* Stop driver mlme relation timer */
r8712_stop_drv_timers(padapter);
r871x_dev_unload(padapter);
+ if (padapter->dvobj_deinit)
+ padapter->dvobj_deinit(padapter);
r8712_free_drv_sw(padapter);
free_netdev(pnetdev);
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 05/51] drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
[not found] <20220607175552.479948-1-sashal@kernel.org>
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 02/51] staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 06/51] drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() Sasha Levin
` (5 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Duoming Zhou, Greg Kroah-Hartman, Sasha Levin, fabioaiuto83,
hdegoede, sevinj.aghayeva, linux-staging
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit cc7ad0d77b51c872d629bcd98aea463a3c4109e7 ]
There is a deadlock in rtw_surveydone_event_callback(),
which is shown below:
(Thread 1) | (Thread 2)
| _set_timer()
rtw_surveydone_event_callback()| mod_timer()
spin_lock_bh() //(1) | (wait a time)
... | rtw_scan_timeout_handler()
del_timer_sync() | spin_lock_bh() //(2)
(wait timer to stop) | ...
We hold pmlmepriv->lock in position (1) of thread 1 and use
del_timer_sync() to wait timer to stop, but timer handler
also need pmlmepriv->lock in position (2) of thread 2.
As a result, rtw_surveydone_event_callback() will block forever.
This patch extracts del_timer_sync() from the protection of
spin_lock_bh(), which could let timer handler to obtain
the needed lock. What`s more, we change spin_lock_bh() in
rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,
spin_lock_bh() will also cause deadlock() in timer handler.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220409061836.60529-1-duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index cf79bec916c5..2c20bf26b10e 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -749,7 +749,9 @@ void rtw_surveydone_event_callback(struct adapter *adapter, u8 *pbuf)
}
if (check_fwstate(pmlmepriv, _FW_UNDER_SURVEY)) {
+ spin_unlock_bh(&pmlmepriv->lock);
del_timer_sync(&pmlmepriv->scan_to_timer);
+ spin_lock_bh(&pmlmepriv->lock);
_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
}
@@ -1584,11 +1586,11 @@ void rtw_scan_timeout_handler(struct timer_list *t)
mlmepriv.scan_to_timer);
struct mlme_priv *pmlmepriv = &adapter->mlmepriv;
- spin_lock_bh(&pmlmepriv->lock);
+ spin_lock_irq(&pmlmepriv->lock);
_clr_fwstate_(pmlmepriv, _FW_UNDER_SURVEY);
- spin_unlock_bh(&pmlmepriv->lock);
+ spin_unlock_irq(&pmlmepriv->lock);
rtw_indicate_scan_done(adapter, true);
}
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 06/51] drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()
[not found] <20220607175552.479948-1-sashal@kernel.org>
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 02/51] staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 05/51] drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 10/51] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() Sasha Levin
` (4 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Duoming Zhou, Greg Kroah-Hartman, Sasha Levin, fabioaiuto83,
hdegoede, sevinj.aghayeva, linux-staging
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc ]
There is a deadlock in rtw_joinbss_event_prehandle(), which is shown
below:
(Thread 1) | (Thread 2)
| _set_timer()
rtw_joinbss_event_prehandle()| mod_timer()
spin_lock_bh() //(1) | (wait a time)
... | _rtw_join_timeout_handler()
del_timer_sync() | spin_lock_bh() //(2)
(wait timer to stop) | ...
We hold pmlmepriv->lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need pmlmepriv->lock in position (2) of thread 2.
As a result, rtw_joinbss_event_prehandle() will block forever.
This patch extracts del_timer_sync() from the protection of
spin_lock_bh(), which could let timer handler to obtain
the needed lock. What`s more, we change spin_lock_bh() to
spin_lock_irq() in _rtw_join_timeout_handler() in order to
prevent deadlock.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220409064953.67420-1-duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index 2c20bf26b10e..952c3e14d1b3 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -1238,8 +1238,10 @@ void rtw_joinbss_event_prehandle(struct adapter *adapter, u8 *pbuf)
spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
+ spin_unlock_bh(&pmlmepriv->lock);
/* s5. Cancel assoc_timer */
del_timer_sync(&pmlmepriv->assoc_timer);
+ spin_lock_bh(&pmlmepriv->lock);
} else {
spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
}
@@ -1545,7 +1547,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
if (adapter->bDriverStopped || adapter->bSurpriseRemoved)
return;
- spin_lock_bh(&pmlmepriv->lock);
+ spin_lock_irq(&pmlmepriv->lock);
if (rtw_to_roam(adapter) > 0) { /* join timeout caused by roaming */
while (1) {
@@ -1573,7 +1575,7 @@ void _rtw_join_timeout_handler(struct timer_list *t)
}
- spin_unlock_bh(&pmlmepriv->lock);
+ spin_unlock_irq(&pmlmepriv->lock);
}
/*
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 10/51] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
[not found] <20220607175552.479948-1-sashal@kernel.org>
` (2 preceding siblings ...)
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 06/51] drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 11/51] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Sasha Levin
` (3 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Duoming Zhou, Greg Kroah-Hartman, Sasha Levin, baihaowen, dave,
len.baker, wangborong, linux-staging
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 806c7b53414934ba2a39449b31fd1a038e500273 ]
There is a deadlock in ieee80211_beacons_stop(), which is shown below:
(Thread 1) | (Thread 2)
| ieee80211_send_beacon()
ieee80211_beacons_stop() | mod_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | ieee80211_send_beacon_cb()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...
We hold ieee->beacon_lock in position (1) of thread 1 and use
del_timer_sync() to wait timer to stop, but timer handler
also need ieee->beacon_lock in position (2) of thread 2.
As a result, ieee80211_beacons_stop() will block forever.
This patch extracts del_timer_sync() from the protection of
spin_lock_irqsave(), which could let timer handler to obtain
the needed lock.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220417135407.109536-1-duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
index 1a193f900779..2b06706a7071 100644
--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c
@@ -528,9 +528,9 @@ static void ieee80211_beacons_stop(struct ieee80211_device *ieee)
spin_lock_irqsave(&ieee->beacon_lock, flags);
ieee->beacon_txing = 0;
- del_timer_sync(&ieee->beacon_timer);
spin_unlock_irqrestore(&ieee->beacon_lock, flags);
+ del_timer_sync(&ieee->beacon_timer);
}
void ieee80211_stop_send_beacons(struct ieee80211_device *ieee)
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 11/51] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
[not found] <20220607175552.479948-1-sashal@kernel.org>
` (3 preceding siblings ...)
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 10/51] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis Sasha Levin
` (2 subsequent siblings)
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Duoming Zhou, Greg Kroah-Hartman, Sasha Levin, baihaowen,
dan.carpenter, edumazet, paskripkin, yangyingliang, wjsota,
len.baker, dave, linux-staging
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 9b6bdbd9337de3917945847bde262a34a87a6303 ]
There is a deadlock in rtllib_beacons_stop(), which is shown
below:
(Thread 1) | (Thread 2)
| rtllib_send_beacon()
rtllib_beacons_stop() | mod_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | rtllib_send_beacon_cb()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...
We hold ieee->beacon_lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need ieee->beacon_lock in position (2) of thread 2.
As a result, rtllib_beacons_stop() will block forever.
This patch extracts del_timer_sync() from the protection of
spin_lock_irqsave(), which could let timer handler to obtain
the needed lock.
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Link: https://lore.kernel.org/r/20220417141641.124388-1-duoming@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8192e/rtllib_softmac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c
index 503d33be71d9..ea8bc27fce49 100644
--- a/drivers/staging/rtl8192e/rtllib_softmac.c
+++ b/drivers/staging/rtl8192e/rtllib_softmac.c
@@ -651,9 +651,9 @@ static void rtllib_beacons_stop(struct rtllib_device *ieee)
spin_lock_irqsave(&ieee->beacon_lock, flags);
ieee->beacon_txing = 0;
- del_timer_sync(&ieee->beacon_timer);
spin_unlock_irqrestore(&ieee->beacon_lock, flags);
+ del_timer_sync(&ieee->beacon_timer);
}
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis
[not found] <20220607175552.479948-1-sashal@kernel.org>
` (4 preceding siblings ...)
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 11/51] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-08 0:04 ` Joe Perches
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 25/51] staging: rtl8712: fix uninit-value in usb_read8() and friends Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 26/51] staging: rtl8712: fix uninit-value in r871xu_drv_init() Sasha Levin
7 siblings, 1 reply; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Soumya Negi, Greg Kroah-Hartman, Sasha Levin, fabioaiuto83,
hdegoede, straube.linux, linux, linux-staging
From: Soumya Negi <soumya.negi97@gmail.com>
[ Upstream commit f722d67fad290b0c960f27062adc8cf59488d0a7 ]
Adhere to Linux coding style. Fixes checkpatch warnings:
CHECK: Alignment should match open parenthesis
CHECK: line length of 101 exceeds 100 columns
Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
Link: https://lore.kernel.org/r/20220513025553.13634-1-soumya.negi97@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8723bs/core/rtw_ap.c | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c
index 6064dd6a76b4..43cd90dc9017 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -519,12 +519,12 @@ void update_sta_info_apmode(struct adapter *padapter, struct sta_info *psta)
/* B0 Config LDPC Coding Capability */
if (TEST_FLAG(phtpriv_ap->ldpc_cap, LDPC_HT_ENABLE_TX) &&
- GET_HT_CAPABILITY_ELE_LDPC_CAP((u8 *)(&phtpriv_sta->ht_cap)))
+ GET_HT_CAPABILITY_ELE_LDPC_CAP((u8 *)(&phtpriv_sta->ht_cap)))
SET_FLAG(cur_ldpc_cap, (LDPC_HT_ENABLE_TX | LDPC_HT_CAP_TX));
/* B7 B8 B9 Config STBC setting */
if (TEST_FLAG(phtpriv_ap->stbc_cap, STBC_HT_ENABLE_TX) &&
- GET_HT_CAPABILITY_ELE_RX_STBC((u8 *)(&phtpriv_sta->ht_cap)))
+ GET_HT_CAPABILITY_ELE_RX_STBC((u8 *)(&phtpriv_sta->ht_cap)))
SET_FLAG(cur_stbc_cap, (STBC_HT_ENABLE_TX | STBC_HT_CAP_TX));
} else {
phtpriv_sta->ampdu_enable = false;
@@ -1064,10 +1064,12 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
);
if ((psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_CCMP) ||
- (psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP)) {
- pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY & (0x07 << 2));
+ (psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP)) {
+ pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY &
+ (0x07 << 2));
} else {
- pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY & 0x00);
+ pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY &
+ 0x00);
}
rtw_hal_get_def_var(
@@ -1115,7 +1117,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
pmlmepriv->htpriv.ht_option = false;
if ((psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_TKIP) ||
- (psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_TKIP)) {
+ (psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_TKIP)) {
/* todo: */
/* ht_cap = false; */
}
@@ -1724,7 +1726,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
pmlmepriv->num_sta_no_short_preamble--;
if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
- (pmlmepriv->num_sta_no_short_preamble == 0)) {
+ (pmlmepriv->num_sta_no_short_preamble == 0)) {
beacon_updated = true;
update_beacon(padapter, 0xFF, NULL, true);
}
@@ -1762,7 +1764,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
pmlmepriv->num_sta_no_short_slot_time++;
if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
- (pmlmepriv->num_sta_no_short_slot_time == 1)) {
+ (pmlmepriv->num_sta_no_short_slot_time == 1)) {
beacon_updated = true;
update_beacon(padapter, 0xFF, NULL, true);
}
@@ -1774,7 +1776,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
pmlmepriv->num_sta_no_short_slot_time--;
if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
- (pmlmepriv->num_sta_no_short_slot_time == 0)) {
+ (pmlmepriv->num_sta_no_short_slot_time == 0)) {
beacon_updated = true;
update_beacon(padapter, 0xFF, NULL, true);
}
@@ -2023,7 +2025,7 @@ void rtw_ap_restore_network(struct adapter *padapter)
start_bss_network(padapter);
if ((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
- (padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
+ (padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
/* restore group key, WEP keys is restored in ips_leave() */
rtw_set_key(
padapter,
@@ -2061,7 +2063,7 @@ void rtw_ap_restore_network(struct adapter *padapter)
/* pairwise key */
/* per sta pairwise key and settings */
if ((psecuritypriv->dot11PrivacyAlgrthm == _TKIP_) ||
- (psecuritypriv->dot11PrivacyAlgrthm == _AES_)) {
+ (psecuritypriv->dot11PrivacyAlgrthm == _AES_)) {
rtw_setstakey_cmd(padapter, psta, true, false);
}
}
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis Sasha Levin
@ 2022-06-08 0:04 ` Joe Perches
2022-06-08 6:15 ` Greg Kroah-Hartman
0 siblings, 1 reply; 11+ messages in thread
From: Joe Perches @ 2022-06-08 0:04 UTC (permalink / raw)
To: Sasha Levin, linux-kernel, stable
Cc: Soumya Negi, Greg Kroah-Hartman, fabioaiuto83, hdegoede,
straube.linux, linux, linux-staging
On Tue, 2022-06-07 at 13:55 -0400, Sasha Levin wrote:
> From: Soumya Negi <soumya.negi97@gmail.com>
>
> [ Upstream commit f722d67fad290b0c960f27062adc8cf59488d0a7 ]
>
> Adhere to Linux coding style. Fixes checkpatch warnings:
> CHECK: Alignment should match open parenthesis
> CHECK: line length of 101 exceeds 100 columns
why should this be backported? It's only whitespace changes.
And beyond that, it's incomplete as it only realigns the second line of
statements that span 3 lines.
>
> Signed-off-by: Soumya Negi <soumya.negi97@gmail.com>
> Link: https://lore.kernel.org/r/20220513025553.13634-1-soumya.negi97@gmail.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/staging/rtl8723bs/core/rtw_ap.c | 24 +++++++++++++-----------
> 1 file changed, 13 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c
> index 6064dd6a76b4..43cd90dc9017 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_ap.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
> @@ -519,12 +519,12 @@ void update_sta_info_apmode(struct adapter *padapter, struct sta_info *psta)
>
> /* B0 Config LDPC Coding Capability */
> if (TEST_FLAG(phtpriv_ap->ldpc_cap, LDPC_HT_ENABLE_TX) &&
> - GET_HT_CAPABILITY_ELE_LDPC_CAP((u8 *)(&phtpriv_sta->ht_cap)))
> + GET_HT_CAPABILITY_ELE_LDPC_CAP((u8 *)(&phtpriv_sta->ht_cap)))
> SET_FLAG(cur_ldpc_cap, (LDPC_HT_ENABLE_TX | LDPC_HT_CAP_TX));
>
> /* B7 B8 B9 Config STBC setting */
> if (TEST_FLAG(phtpriv_ap->stbc_cap, STBC_HT_ENABLE_TX) &&
> - GET_HT_CAPABILITY_ELE_RX_STBC((u8 *)(&phtpriv_sta->ht_cap)))
> + GET_HT_CAPABILITY_ELE_RX_STBC((u8 *)(&phtpriv_sta->ht_cap)))
> SET_FLAG(cur_stbc_cap, (STBC_HT_ENABLE_TX | STBC_HT_CAP_TX));
> } else {
> phtpriv_sta->ampdu_enable = false;
> @@ -1064,10 +1064,12 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
> );
>
> if ((psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_CCMP) ||
> - (psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP)) {
> - pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY & (0x07 << 2));
> + (psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_CCMP)) {
> + pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY &
> + (0x07 << 2));
> } else {
> - pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY & 0x00);
> + pht_cap->ampdu_params_info |= (IEEE80211_HT_CAP_AMPDU_DENSITY &
> + 0x00);
> }
>
> rtw_hal_get_def_var(
> @@ -1115,7 +1117,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len)
> pmlmepriv->htpriv.ht_option = false;
>
> if ((psecuritypriv->wpa2_pairwise_cipher & WPA_CIPHER_TKIP) ||
> - (psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_TKIP)) {
> + (psecuritypriv->wpa_pairwise_cipher & WPA_CIPHER_TKIP)) {
> /* todo: */
> /* ht_cap = false; */
> }
> @@ -1724,7 +1726,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
> pmlmepriv->num_sta_no_short_preamble--;
>
> if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
> - (pmlmepriv->num_sta_no_short_preamble == 0)) {
> + (pmlmepriv->num_sta_no_short_preamble == 0)) {
> beacon_updated = true;
> update_beacon(padapter, 0xFF, NULL, true);
> }
> @@ -1762,7 +1764,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
> pmlmepriv->num_sta_no_short_slot_time++;
>
> if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
> - (pmlmepriv->num_sta_no_short_slot_time == 1)) {
> + (pmlmepriv->num_sta_no_short_slot_time == 1)) {
> beacon_updated = true;
> update_beacon(padapter, 0xFF, NULL, true);
> }
> @@ -1774,7 +1776,7 @@ void bss_cap_update_on_sta_join(struct adapter *padapter, struct sta_info *psta)
> pmlmepriv->num_sta_no_short_slot_time--;
>
> if ((pmlmeext->cur_wireless_mode > WIRELESS_11B) &&
> - (pmlmepriv->num_sta_no_short_slot_time == 0)) {
> + (pmlmepriv->num_sta_no_short_slot_time == 0)) {
> beacon_updated = true;
> update_beacon(padapter, 0xFF, NULL, true);
> }
> @@ -2023,7 +2025,7 @@ void rtw_ap_restore_network(struct adapter *padapter)
> start_bss_network(padapter);
>
> if ((padapter->securitypriv.dot11PrivacyAlgrthm == _TKIP_) ||
> - (padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
> + (padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
> /* restore group key, WEP keys is restored in ips_leave() */
> rtw_set_key(
> padapter,
> @@ -2061,7 +2063,7 @@ void rtw_ap_restore_network(struct adapter *padapter)
> /* pairwise key */
> /* per sta pairwise key and settings */
> if ((psecuritypriv->dot11PrivacyAlgrthm == _TKIP_) ||
> - (psecuritypriv->dot11PrivacyAlgrthm == _AES_)) {
> + (psecuritypriv->dot11PrivacyAlgrthm == _AES_)) {
> rtw_setstakey_cmd(padapter, psta, true, false);
> }
> }
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis
2022-06-08 0:04 ` Joe Perches
@ 2022-06-08 6:15 ` Greg Kroah-Hartman
2022-06-09 13:55 ` Sasha Levin
0 siblings, 1 reply; 11+ messages in thread
From: Greg Kroah-Hartman @ 2022-06-08 6:15 UTC (permalink / raw)
To: Joe Perches
Cc: Sasha Levin, linux-kernel, stable, Soumya Negi, fabioaiuto83,
hdegoede, straube.linux, linux, linux-staging
On Tue, Jun 07, 2022 at 05:04:08PM -0700, Joe Perches wrote:
> On Tue, 2022-06-07 at 13:55 -0400, Sasha Levin wrote:
> > From: Soumya Negi <soumya.negi97@gmail.com>
> >
> > [ Upstream commit f722d67fad290b0c960f27062adc8cf59488d0a7 ]
> >
> > Adhere to Linux coding style. Fixes checkpatch warnings:
> > CHECK: Alignment should match open parenthesis
> > CHECK: line length of 101 exceeds 100 columns
>
> why should this be backported? It's only whitespace changes.
Good catch, it should not.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis
2022-06-08 6:15 ` Greg Kroah-Hartman
@ 2022-06-09 13:55 ` Sasha Levin
0 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-09 13:55 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Joe Perches, linux-kernel, stable, Soumya Negi, fabioaiuto83,
hdegoede, straube.linux, linux, linux-staging
On Wed, Jun 08, 2022 at 08:15:52AM +0200, Greg Kroah-Hartman wrote:
>On Tue, Jun 07, 2022 at 05:04:08PM -0700, Joe Perches wrote:
>> On Tue, 2022-06-07 at 13:55 -0400, Sasha Levin wrote:
>> > From: Soumya Negi <soumya.negi97@gmail.com>
>> >
>> > [ Upstream commit f722d67fad290b0c960f27062adc8cf59488d0a7 ]
>> >
>> > Adhere to Linux coding style. Fixes checkpatch warnings:
>> > CHECK: Alignment should match open parenthesis
>> > CHECK: line length of 101 exceeds 100 columns
>>
>> why should this be backported? It's only whitespace changes.
>
>Good catch, it should not.
It shouldn't :/
Dropped, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH AUTOSEL 5.15 25/51] staging: rtl8712: fix uninit-value in usb_read8() and friends
[not found] <20220607175552.479948-1-sashal@kernel.org>
` (5 preceding siblings ...)
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 26/51] staging: rtl8712: fix uninit-value in r871xu_drv_init() Sasha Levin
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wang Cheng, syzbot+6f5ecd144854c0d8580b, Dan Carpenter,
Greg Kroah-Hartman, Sasha Levin, Larry.Finger,
florian.c.schilhabel, linux-staging
From: Wang Cheng <wanngchenng@gmail.com>
[ Upstream commit d1b57669732d09da7e13ef86d058dab0cd57f6e0 ]
When r8712_usbctrl_vendorreq() returns negative, 'data' in
usb_read{8,16,32} will not be initialized.
BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:643 [inline]
BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725
string_nocheck lib/vsprintf.c:643 [inline]
string+0x4ec/0x6f0 lib/vsprintf.c:725
vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806
va_format lib/vsprintf.c:1704 [inline]
pointer+0x18e6/0x1f70 lib/vsprintf.c:2443
vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810
vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158
vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256
dev_vprintk_emit+0x5ef/0x6d0 drivers/base/core.c:4604
dev_printk_emit+0x1dd/0x21f drivers/base/core.c:4615
__dev_printk+0x3be/0x440 drivers/base/core.c:4627
_dev_info+0x1ea/0x22f drivers/base/core.c:4673
r871xu_drv_init+0x1929/0x3070 drivers/staging/rtl8712/usb_intf.c:401
usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
really_probe+0x6c7/0x1350 drivers/base/dd.c:621
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
driver_probe_device drivers/base/dd.c:782 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:970
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
really_probe+0x6c7/0x1350 drivers/base/dd.c:621
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
driver_probe_device drivers/base/dd.c:782 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:970
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_new_device+0x1b91/0x2950 drivers/usb/core/hub.c:2566
hub_port_connect drivers/usb/core/hub.c:5363 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5507 [inline]
port_event drivers/usb/core/hub.c:5665 [inline]
hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5747
process_one_work+0xdb6/0x1820 kernel/workqueue.c:2289
worker_thread+0x10d0/0x2240 kernel/workqueue.c:2436
kthread+0x3c7/0x500 kernel/kthread.c:376
ret_from_fork+0x1f/0x30
Local variable data created at:
usb_read8+0x5d/0x130 drivers/staging/rtl8712/usb_ops.c:33
r8712_read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712_io.c:29
KMSAN: uninit-value in r871xu_drv_init
https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
Link: https://lore.kernel.org/r/b9b7a6ee02c02aa28054f5cf16129977775f3cd9.1652618244.git.wanngchenng@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8712/usb_ops.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/rtl8712/usb_ops.c b/drivers/staging/rtl8712/usb_ops.c
index e64845e6adf3..af9966d03979 100644
--- a/drivers/staging/rtl8712/usb_ops.c
+++ b/drivers/staging/rtl8712/usb_ops.c
@@ -29,7 +29,8 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
u16 wvalue;
u16 index;
u16 len;
- __le32 data;
+ int status;
+ __le32 data = 0;
struct intf_priv *intfpriv = intfhdl->pintfpriv;
request = 0x05;
@@ -37,8 +38,10 @@ static u8 usb_read8(struct intf_hdl *intfhdl, u32 addr)
index = 0;
wvalue = (u16)(addr & 0x0000ffff);
len = 1;
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
+ &data, len, requesttype);
+ if (status < 0)
+ return 0;
return (u8)(le32_to_cpu(data) & 0x0ff);
}
@@ -49,7 +52,8 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
u16 wvalue;
u16 index;
u16 len;
- __le32 data;
+ int status;
+ __le32 data = 0;
struct intf_priv *intfpriv = intfhdl->pintfpriv;
request = 0x05;
@@ -57,8 +61,10 @@ static u16 usb_read16(struct intf_hdl *intfhdl, u32 addr)
index = 0;
wvalue = (u16)(addr & 0x0000ffff);
len = 2;
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
+ &data, len, requesttype);
+ if (status < 0)
+ return 0;
return (u16)(le32_to_cpu(data) & 0xffff);
}
@@ -69,7 +75,8 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
u16 wvalue;
u16 index;
u16 len;
- __le32 data;
+ int status;
+ __le32 data = 0;
struct intf_priv *intfpriv = intfhdl->pintfpriv;
request = 0x05;
@@ -77,8 +84,10 @@ static u32 usb_read32(struct intf_hdl *intfhdl, u32 addr)
index = 0;
wvalue = (u16)(addr & 0x0000ffff);
len = 4;
- r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index, &data, len,
- requesttype);
+ status = r8712_usbctrl_vendorreq(intfpriv, request, wvalue, index,
+ &data, len, requesttype);
+ if (status < 0)
+ return 0;
return le32_to_cpu(data);
}
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread* [PATCH AUTOSEL 5.15 26/51] staging: rtl8712: fix uninit-value in r871xu_drv_init()
[not found] <20220607175552.479948-1-sashal@kernel.org>
` (6 preceding siblings ...)
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 25/51] staging: rtl8712: fix uninit-value in usb_read8() and friends Sasha Levin
@ 2022-06-07 17:55 ` Sasha Levin
7 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2022-06-07 17:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Wang Cheng, syzbot+6f5ecd144854c0d8580b, Dan Carpenter,
Greg Kroah-Hartman, Sasha Levin, Larry.Finger,
florian.c.schilhabel, paskripkin, fmdefrancesco, xkernel.wang,
skumark1902, kuba, linux-staging
From: Wang Cheng <wanngchenng@gmail.com>
[ Upstream commit 0458e5428e5e959d201a40ffe71d762a79ecedc4 ]
When 'tmpU1b' returns from r8712_read8(padapter, EE_9346CR) is 0,
'mac[6]' will not be initialized.
BUG: KMSAN: uninit-value in r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
r871xu_drv_init+0x2d54/0x3070 drivers/staging/rtl8712/usb_intf.c:541
usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
really_probe+0x653/0x14b0 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
driver_probe_device drivers/base/dd.c:782 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:970
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_set_configuration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170
usb_generic_driver_probe+0x13c/0x300 drivers/usb/core/generic.c:238
usb_probe_device+0x309/0x570 drivers/usb/core/driver.c:293
really_probe+0x653/0x14b0 drivers/base/dd.c:596
__driver_probe_device+0x3e9/0x530 drivers/base/dd.c:752
driver_probe_device drivers/base/dd.c:782 [inline]
__device_attach_driver+0x79f/0x1120 drivers/base/dd.c:899
bus_for_each_drv+0x2d6/0x3f0 drivers/base/bus.c:427
__device_attach+0x593/0x8e0 drivers/base/dd.c:970
device_initial_probe+0x4a/0x60 drivers/base/dd.c:1017
bus_probe_device+0x17b/0x3e0 drivers/base/bus.c:487
device_add+0x1fff/0x26e0 drivers/base/core.c:3405
usb_new_device+0x1b8e/0x2950 drivers/usb/core/hub.c:2566
hub_port_connect drivers/usb/core/hub.c:5358 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
port_event drivers/usb/core/hub.c:5660 [inline]
hub_event+0x58e3/0x89e0 drivers/usb/core/hub.c:5742
process_one_work+0xdb6/0x1820 kernel/workqueue.c:2307
worker_thread+0x10b3/0x21e0 kernel/workqueue.c:2454
kthread+0x3c7/0x500 kernel/kthread.c:377
ret_from_fork+0x1f/0x30
Local variable mac created at:
r871xu_drv_init+0x1771/0x3070 drivers/staging/rtl8712/usb_intf.c:394
usb_probe_interface+0xf19/0x1600 drivers/usb/core/driver.c:396
KMSAN: uninit-value in r871xu_drv_init
https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
Reported-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
Tested-by: <syzbot+6f5ecd144854c0d8580b@syzkaller.appspotmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Wang Cheng <wanngchenng@gmail.com>
Link: https://lore.kernel.org/r/14c3886173dfa4597f0704547c414cfdbcd11d16.1652618244.git.wanngchenng@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/rtl8712/usb_intf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index a61dd96ab2a4..6db2493e6d3a 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -536,13 +536,13 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
} else {
AutoloadFail = false;
}
- if (((mac[0] == 0xff) && (mac[1] == 0xff) &&
+ if ((!AutoloadFail) ||
+ ((mac[0] == 0xff) && (mac[1] == 0xff) &&
(mac[2] == 0xff) && (mac[3] == 0xff) &&
(mac[4] == 0xff) && (mac[5] == 0xff)) ||
((mac[0] == 0x00) && (mac[1] == 0x00) &&
(mac[2] == 0x00) && (mac[3] == 0x00) &&
- (mac[4] == 0x00) && (mac[5] == 0x00)) ||
- (!AutoloadFail)) {
+ (mac[4] == 0x00) && (mac[5] == 0x00))) {
mac[0] = 0x00;
mac[1] = 0xe0;
mac[2] = 0x4c;
--
2.35.1
^ permalink raw reply related [flat|nested] 11+ messages in thread