[PATCH 00/22] staging: rtl87232bs: Fix errors and warnings detected by Smatch

[PATCH 00/22] staging: rtl87232bs: Fix errors and warnings detected by Smatch

[Larry Finger]

A number of routines have indenting, off by one, and possible usage
while null warnings or errors listed by Smatch. This set of patches
fix all but one of these, and it is in code that will be removed in a
subsequent patch.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>


Larry Finger (22):
  staging: rtl8723bs: Fix indenting warning in os_dep/xmit_linux.c
  staging: rtl8723bs: Fix indenting warning in os_dep/rtw_proc.c
  staging: rtl8723bs: Fix dereference before check warning in
    os_dep/recv_linux.c
  staging: rtl8723bs: Fix indenting warning in os_dep/os_intfs.c
  staging: rtl8723bs: Fix indenting mistake in os_dep/mlme_linux.c
  staging: rtl8723bs: Fix various errors in os_dep/ioctl_cfg80211.c
  staging: rtl8723bs: Fix potential usage while NULL error in
    hal/rtl8723b_hal_init.c
  staging: rtl8723bs: Fix indenting problems in hal/HalHWImg8723B_BB.c
  staging: rtl8723bs: Fix indening problem in hal/hal_com_phycfg.c
  staging: rtl8723bs: Fix indenting problem for hal/hal_com.c
  staging: rtl8723bs: Fix indenting problems in core/rtw_xmit.c
  staging: rtl8723bs: Fix possible usage of NULL pointer in
    core/rtw_debug.c
  staging: rtl8723bs: Fix indenting mistake in core/rtw_ap.c
  staging: rtl8723bs: Fix indenting mistakes in core/rtw_ieee80211.c
  staging: rtl8723bs: Fix indenting mistakes in core/rtw_mlme.c
  staging: rtl8723bs: Fix some indenting problems and a potential data
    overrun
  staging: rtl8723bs: Fix indenting problem in core/rtw_sta_mgt.c
  staging: rtl8723bs: Fix some white-space errors in core/rtw_security.c
  staging: rtl8723bs: Fix white-space errors in core/rtw_recv.c
  staging rtl8723bs: Fix indenting errors and an off-by-one mistake in
    core/rtw_mlme_ext.c
  staging: rtl8723bs: Fix indenting problems in core/rtw_odm.c
  staging: rtlwifi: Fix indenting error in core/rtw_pwrctrl.c

 drivers/staging/rtl8723bs/core/rtw_ap.c           |  99 +++--
 drivers/staging/rtl8723bs/core/rtw_debug.c        |   1 -
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c    |  13 +-
 drivers/staging/rtl8723bs/core/rtw_mlme.c         |  37 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c     |  25 +-
 drivers/staging/rtl8723bs/core/rtw_odm.c          |  10 +-
 drivers/staging/rtl8723bs/core/rtw_pwrctrl.c      |   2 +-
 drivers/staging/rtl8723bs/core/rtw_recv.c         |  21 +-
 drivers/staging/rtl8723bs/core/rtw_security.c     | 469 +++++++++++-----------
 drivers/staging/rtl8723bs/core/rtw_sta_mgt.c      |   2 +-
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c    |  10 +-
 drivers/staging/rtl8723bs/core/rtw_xmit.c         |  10 +-
 drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c  |   6 +-
 drivers/staging/rtl8723bs/hal/hal_com.c           |  10 +-
 drivers/staging/rtl8723bs/hal/hal_com_phycfg.c    |   2 +-
 drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c |  13 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c |  38 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c    |   2 +-
 drivers/staging/rtl8723bs/os_dep/mlme_linux.c     |   4 +-
 drivers/staging/rtl8723bs/os_dep/os_intfs.c       |   2 +-
 drivers/staging/rtl8723bs/os_dep/recv_linux.c     |   3 +-
 drivers/staging/rtl8723bs/os_dep/rtw_proc.c       |   3 +-
 drivers/staging/rtl8723bs/os_dep/xmit_linux.c     |   2 +-
 23 files changed, 375 insertions(+), 409 deletions(-)

-- 
2.12.0

[PATCH 01/22] staging: rtl8723bs: Fix indenting warning in os_dep/xmit_linux.c

[Larry Finger]

Smatch issues the warning

  CHECK   drivers/staging/rtl8723bs/os_dep/xmit_linux.c
drivers/staging/rtl8723bs/os_dep/xmit_linux.c:42 _rtw_pktfile_read() warn: inconsistent indenting

A simple indent changes fixes this.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/xmit_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/xmit_linux.c b/drivers/staging/rtl8723bs/os_dep/xmit_linux.c
index 5ede3b6fbdec..66dfec18f770 100644
--- a/drivers/staging/rtl8723bs/os_dep/xmit_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/xmit_linux.c
@@ -39,7 +39,7 @@ uint _rtw_pktfile_read (struct pkt_file *pfile, u8 *rmem, uint rlen)
 	len =  rtw_remainder_len(pfile);
 	len = (rlen > len)? len: rlen;
 
-       if (rmem)
+	if (rmem)
 		skb_copy_bits(pfile->pkt, pfile->buf_len-pfile->pkt_len, rmem, len);
 
 	pfile->cur_addr += len;
-- 
2.12.0

[PATCH 02/22] staging: rtl8723bs: Fix indenting warning in os_dep/rtw_proc.c

[Larry Finger]

Smatch lists the following warning:

  CHECK   drivers/staging/rtl8723bs/os_dep/rtw_proc.c
drivers/staging/rtl8723bs/os_dep/rtw_proc.c:102 rtw_drv_proc_open() warn: inconsistent indenting

This warning is fixed with a simple change in the white space.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/rtw_proc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
index 4088381dff35..a2011e06d719 100644
--- a/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
+++ b/drivers/staging/rtl8723bs/os_dep/rtw_proc.c
@@ -99,7 +99,8 @@ static int rtw_drv_proc_open(struct inode *inode, struct file *file)
 	/* struct net_device *dev = proc_get_parent_data(inode); */
 	ssize_t index = (ssize_t)PDE_DATA(inode);
 	const struct rtw_proc_hdl *hdl = drv_proc_hdls+index;
-       return single_open(file, hdl->show, NULL);
+
+	return single_open(file, hdl->show, NULL);
 }
 
 static ssize_t rtw_drv_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *pos)
-- 
2.12.0

[PATCH 03/22] staging: rtl8723bs: Fix dereference before check warning in os_dep/recv_linux.c

[Larry Finger]

Smatch lists the following warning:

  CHECK   drivers/staging/rtl8723bs/os_dep/recv_linux.c
drivers/staging/rtl8723bs/os_dep/recv_linux.c:353 rtw_recv_indicatepkt() warn: variable dereferenced before check 'precv_frame' (see line 312)

This warning is fixed by removing the test at line 353.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/recv_linux.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/recv_linux.c b/drivers/staging/rtl8723bs/os_dep/recv_linux.c
index c677a5216b54..e731ab4e2bd7 100644
--- a/drivers/staging/rtl8723bs/os_dep/recv_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/recv_linux.c
@@ -350,8 +350,7 @@ int rtw_recv_indicatepkt(struct adapter *padapter, union recv_frame *precv_frame
 _recv_indicatepkt_drop:
 
 	 /* enqueue back to free_recv_queue */
-	 if (precv_frame)
-		 rtw_free_recvframe(precv_frame, pfree_recv_queue);
+	 rtw_free_recvframe(precv_frame, pfree_recv_queue);
 
 	 DBG_COUNTER(padapter->rx_logs.os_indicate_err);
 	 return _FAIL;
-- 
2.12.0

[PATCH 04/22] staging: rtl8723bs: Fix indenting warning in os_dep/os_intfs.c

[Larry Finger]

Smatch logs the following warning:

  CHECK   drivers/staging/rtl8723bs/os_dep/os_intfs.c
drivers/staging/rtl8723bs/os_dep/os_intfs.c:1082 ips_netdrv_open() warn: inconsistent indenting

A simple change in the white space handles this warning.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/os_intfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
index 2ed3067b4af0..843be2cc6c10 100644
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -1079,7 +1079,7 @@ static int  ips_netdrv_open(struct adapter *padapter)
 
 	_set_timer(&padapter->mlmepriv.dynamic_chk_timer, 2000);
 
-	 return _SUCCESS;
+	return _SUCCESS;
 
 netdev_open_error:
 	/* padapter->bup = false; */
-- 
2.12.0

[PATCH 05/22] staging: rtl8723bs: Fix indenting mistake in os_dep/mlme_linux.c

[Larry Finger]

Smatch reports the following warning:

  CHECK   drivers/staging/rtl8723bs/os_dep/mlme_linux.c
drivers/staging/rtl8723bs/os_dep/mlme_linux.c:149 rtw_os_indicate_disconnect() warn: inconsistent indenting

Again, a simple change in the white space fixes this problem.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/mlme_linux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/mlme_linux.c b/drivers/staging/rtl8723bs/os_dep/mlme_linux.c
index aa1793389797..46315d1a82f7 100644
--- a/drivers/staging/rtl8723bs/os_dep/mlme_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/mlme_linux.c
@@ -145,8 +145,8 @@ void rtw_os_indicate_disconnect(struct adapter *adapter)
 
 	rtw_indicate_wx_disassoc_event(adapter);
 
-	 /* modify for CONFIG_IEEE80211W, none 11w also can use the same command */
-	 rtw_reset_securitypriv_cmd(adapter);
+	/* modify for CONFIG_IEEE80211W, none 11w also can use the same command */
+	rtw_reset_securitypriv_cmd(adapter);
 }
 
 void rtw_report_sec_ie(struct adapter *adapter, u8 authmode, u8 *sec_ie)
-- 
2.12.0

[PATCH 06/22] staging: rtl8723bs: Fix various errors in os_dep/ioctl_cfg80211.c

[Larry Finger]

Smatch lists the following:

  CHECK   drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:470 rtw_cfg80211_ibss_indicate_connect() error: we previously assumed 'scanned' could be null (see line 466)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:942 rtw_cfg80211_set_encryption() warn: inconsistent indenting
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:955 rtw_cfg80211_set_encryption() error: buffer overflow 'psecuritypriv->dot11DefKey' 4 <= 4
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1017 rtw_cfg80211_set_encryption() error: buffer overflow 'padapter->securitypriv.dot118021XGrpKey' 5 <= 5
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1216 cfg80211_rtw_set_default_key() warn: inconsistent indenting
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2498 rtw_cfg80211_monitor_if_xmit_entry() error: we previously assumed 'skb' could be null (see line 2495)
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2850 cfg80211_rtw_start_ap() warn: if statement not indented
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2860 cfg80211_rtw_start_ap() warn: if statement not indented
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3417 rtw_cfg80211_preinit_wiphy() warn: inconsistent indenting
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3547 rtw_wdev_alloc() info: ignoring unreachable code.

The indenting warnings were fixed by simple white space changes.

The section where 'scanned' could be null required an immediate exit from
the routine at that point. A similar fix was required where 'skb' could be null.

The two buffer overflow errors were caused by off-by-one errors. While
locating these problems, another one was found in os_dep/ioctl_linux.c.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 38 +++++++++--------------
 drivers/staging/rtl8723bs/os_dep/ioctl_linux.c    |  2 +-
 2 files changed, 15 insertions(+), 25 deletions(-)

diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index ce7cca68ff7a..d2c66041a561 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -463,9 +463,10 @@ void rtw_cfg80211_ibss_indicate_connect(struct adapter *padapter)
 		}
 		else
 		{
-			if (scanned == NULL)
+			if (scanned == NULL) {
 				rtw_warn_on(1);
-
+				return;
+			}
 			if (!memcmp(&(scanned->network.Ssid), &(pnetwork->Ssid), sizeof(struct ndis_802_11_ssid))
 				&& !memcmp(scanned->network.MacAddress, pnetwork->MacAddress, sizeof(NDIS_802_11_MAC_ADDRESS))
 			) {
@@ -906,7 +907,7 @@ static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param
 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
 	{
 		if (param->u.crypt.idx >= WEP_KEYS
-			&& param->u.crypt.idx > BIP_MAX_KEYID
+			|| param->u.crypt.idx >= BIP_MAX_KEYID
 		)
 		{
 			ret = -EINVAL;
@@ -927,7 +928,7 @@ static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param
 		wep_key_idx = param->u.crypt.idx;
 		wep_key_len = param->u.crypt.key_len;
 
-		if ((wep_key_idx > WEP_KEYS) || (wep_key_len <= 0))
+		if ((wep_key_idx >= WEP_KEYS) || (wep_key_len <= 0))
 		{
 			ret = -EINVAL;
 			goto exit;
@@ -939,7 +940,7 @@ static int rtw_cfg80211_set_encryption(struct net_device *dev, struct ieee_param
 
 			wep_key_len = wep_key_len <= 5 ? 5 : 13;
 
-		psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
+			psecuritypriv->ndisencryptstatus = Ndis802_11Encryption1Enabled;
 			psecuritypriv->dot11PrivacyAlgrthm = _WEP40_;
 			psecuritypriv->dot118021XGrpPrivacy = _WEP40_;
 
@@ -1213,11 +1214,8 @@ static int cfg80211_rtw_set_default_key(struct wiphy *wiphy,
 	struct adapter *padapter = (struct adapter *)rtw_netdev_priv(ndev);
 	struct security_priv *psecuritypriv = &padapter->securitypriv;
 
-		DBG_871X(FUNC_NDEV_FMT" key_index =%d"
-		", unicast =%d, multicast =%d"
-		".\n", FUNC_NDEV_ARG(ndev), key_index
-		, unicast, multicast
-		);
+	DBG_871X(FUNC_NDEV_FMT" key_index =%d, unicast =%d, multicast =%d\n",
+		 FUNC_NDEV_ARG(ndev), key_index, unicast, multicast);
 
 	if ((key_index < WEP_KEYS) && ((psecuritypriv->dot11PrivacyAlgrthm == _WEP40_) || (psecuritypriv->dot11PrivacyAlgrthm == _WEP104_))) /* set wep default key */
 	{
@@ -2492,8 +2490,10 @@ static int rtw_cfg80211_monitor_if_xmit_entry(struct sk_buff *skb, struct net_de
 
 	DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(ndev));
 
-	if (skb)
-		rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, skb->truesize);
+	if (!skb)
+		goto fail;
+
+	rtw_mstat_update(MSTAT_TYPE_SKB, MSTAT_ALLOC_SUCCESS, skb->truesize);
 
 	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
 		goto fail;
@@ -2847,20 +2847,10 @@ static int cfg80211_rtw_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 		struct wlan_bssid_ex *pbss_network = &adapter->mlmepriv.cur_network.network;
 		struct wlan_bssid_ex *pbss_network_ext = &adapter->mlmeextpriv.mlmext_info.network;
 
-		if (0)
-		DBG_871X(FUNC_ADPT_FMT" ssid:(%s,%zu), from ie:(%s,%d)\n", FUNC_ADPT_ARG(adapter),
-			settings->ssid, settings->ssid_len,
-			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength);
-
 		memcpy(pbss_network->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
 		pbss_network->Ssid.SsidLength = settings->ssid_len;
 		memcpy(pbss_network_ext->Ssid.Ssid, (void *)settings->ssid, settings->ssid_len);
 		pbss_network_ext->Ssid.SsidLength = settings->ssid_len;
-
-		if (0)
-		DBG_871X(FUNC_ADPT_FMT" after ssid:(%s,%d), (%s,%d)\n", FUNC_ADPT_ARG(adapter),
-			pbss_network->Ssid.Ssid, pbss_network->Ssid.SsidLength,
-			pbss_network_ext->Ssid.Ssid, pbss_network_ext->Ssid.SsidLength);
 	}
 
 	return ret;
@@ -3414,7 +3404,7 @@ static void rtw_cfg80211_preinit_wiphy(struct adapter *padapter, struct wiphy *w
 	wiphy->n_cipher_suites = ARRAY_SIZE(rtw_cipher_suites);
 
 	/* if (padapter->registrypriv.wireless_mode & WIRELESS_11G) */
-		wiphy->bands[NL80211_BAND_2GHZ] = rtw_spt_band_alloc(NL80211_BAND_2GHZ);
+	wiphy->bands[NL80211_BAND_2GHZ] = rtw_spt_band_alloc(NL80211_BAND_2GHZ);
 
 	wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 	wiphy->flags |= WIPHY_FLAG_OFFCHAN_TX | WIPHY_FLAG_HAVE_AP_SME;
@@ -3541,10 +3531,10 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev)
 		pwdev_priv->power_mgmt = true;
 	else
 		pwdev_priv->power_mgmt = false;
+	kfree((u8 *)wdev);
 
 	return ret;
 
-	kfree((u8 *)wdev);
 unregister_wiphy:
 	wiphy_unregister(wiphy);
  free_wiphy:
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index 3faa5d943466..fe3c42a0da31 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -570,7 +570,7 @@ static int wpa_set_encryption(struct net_device *dev, struct ieee_param *param,
 	    param->sta_addr[4] == 0xff && param->sta_addr[5] == 0xff)
 	{
 
-		if (param->u.crypt.idx >= WEP_KEYS &&
+		if (param->u.crypt.idx >= WEP_KEYS ||
 		    param->u.crypt.idx >= BIP_MAX_KEYID) {
 			ret = -EINVAL;
 			goto exit;
-- 
2.12.0

Re: [PATCH 06/22] staging: rtl8723bs: Fix various errors in os_dep/ioctl_cfg80211.c

[Bastien Nocera]

On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
> Smatch lists the following:
> 
>   CHECK   drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:470
> rtw_cfg80211_ibss_indicate_connect() error: we previously assumed
> 'scanned' could be null (see line 466)
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:942
> rtw_cfg80211_set_encryption() warn: inconsistent indenting
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:955
> rtw_cfg80211_set_encryption() error: buffer overflow 'psecuritypriv-
> >dot11DefKey' 4 <= 4
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1017
> rtw_cfg80211_set_encryption() error: buffer overflow 'padapter-
> >securitypriv.dot118021XGrpKey' 5 <= 5
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1216
> cfg80211_rtw_set_default_key() warn: inconsistent indenting
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2498
> rtw_cfg80211_monitor_if_xmit_entry() error: we previously assumed
> 'skb' could be null (see line 2495)
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2850
> cfg80211_rtw_start_ap() warn: if statement not indented
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2860
> cfg80211_rtw_start_ap() warn: if statement not indented
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3417
> rtw_cfg80211_preinit_wiphy() warn: inconsistent indenting
> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3547
> rtw_wdev_alloc() info: ignoring unreachable code.
> 
> The indenting warnings were fixed by simple white space changes.
> 
> The section where 'scanned' could be null required an immediate exit
> from
> the routine at that point. A similar fix was required where 'skb'
> could be null.
> 
> The two buffer overflow errors were caused by off-by-one errors.
> While
> locating these problems, another one was found in
> os_dep/ioctl_linux.c.

Could you please split those up into patches that fix one kind of
problem? Makes it easier to review.

Re: [PATCH 06/22] staging: rtl8723bs: Fix various errors in os_dep/ioctl_cfg80211.c

[Larry Finger]

On 04/09/2017 10:28 AM, Bastien Nocera wrote:
> On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
>> Smatch lists the following:
>>
>>   CHECK   drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:470
>> rtw_cfg80211_ibss_indicate_connect() error: we previously assumed
>> 'scanned' could be null (see line 466)
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:942
>> rtw_cfg80211_set_encryption() warn: inconsistent indenting
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:955
>> rtw_cfg80211_set_encryption() error: buffer overflow 'psecuritypriv-
>>> dot11DefKey' 4 <= 4
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1017
>> rtw_cfg80211_set_encryption() error: buffer overflow 'padapter-
>>> securitypriv.dot118021XGrpKey' 5 <= 5
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:1216
>> cfg80211_rtw_set_default_key() warn: inconsistent indenting
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2498
>> rtw_cfg80211_monitor_if_xmit_entry() error: we previously assumed
>> 'skb' could be null (see line 2495)
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2850
>> cfg80211_rtw_start_ap() warn: if statement not indented
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2860
>> cfg80211_rtw_start_ap() warn: if statement not indented
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3417
>> rtw_cfg80211_preinit_wiphy() warn: inconsistent indenting
>> drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:3547
>> rtw_wdev_alloc() info: ignoring unreachable code.
>>
>> The indenting warnings were fixed by simple white space changes.
>>
>> The section where 'scanned' could be null required an immediate exit
>> from
>> the routine at that point. A similar fix was required where 'skb'
>> could be null.
>>
>> The two buffer overflow errors were caused by off-by-one errors.
>> While
>> locating these problems, another one was found in
>> os_dep/ioctl_linux.c.
>
> Could you please split those up into patches that fix one kind of
> problem? Makes it easier to review.

These patches were merged earlier today. Thanks for the reviews.

Larry

[PATCH 07/22] staging: rtl8723bs: Fix potential usage while NULL error in hal/rtl8723b_hal_init.c

[Larry Finger]

Smatch logs the following:

  CHECK   drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c:518 rtl8723b_FirmwareDownload() error: we previously assumed 'pFirmware' could be null (see line 382)

Fixing this error required a rewrite of the error exits from this routine.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
index b7f6dc7ce318..d40ad03e99a3 100644
--- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
+++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
@@ -377,13 +377,13 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
 	RT_TRACE(_module_hal_init_c_, _drv_notice_, ("+%s, bUsedWoWLANFw:%d\n", __func__, bUsedWoWLANFw));
 #endif
 	pFirmware = kzalloc(sizeof(struct rt_firmware), GFP_KERNEL);
+	if (!pFirmware)
+		return _FAIL;
 	pBTFirmware = kzalloc(sizeof(struct rt_firmware), GFP_KERNEL);
-
-	if (!pFirmware || !pBTFirmware) {
-		rtStatus = _FAIL;
-		goto exit;
+	if (!pBTFirmware) {
+		kfree(pFirmware);
+		return _FAIL;
 	}
-
 	tmp_ps = rtw_read8(padapter, 0xa3);
 	tmp_ps &= 0xf8;
 	tmp_ps |= 0x02;
@@ -441,7 +441,7 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
 	if (pFirmware->ulFwLength > FW_8723B_SIZE) {
 		rtStatus = _FAIL;
 		DBG_871X_LEVEL(_drv_emerg_, "Firmware size:%u exceed %u\n", pFirmware->ulFwLength, FW_8723B_SIZE);
-		goto exit;
+		goto release_fw1;
 	}
 
 	pFirmwareBuf = pFirmware->szFwBuffer;
@@ -517,6 +517,7 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
 exit:
 	kfree(pFirmware->szFwBuffer);
 	kfree(pFirmware);
+release_fw1:
 	kfree(pBTFirmware);
 	DBG_871X(" <=== rtl8723b_FirmwareDownload()\n");
 	return rtStatus;
-- 
2.12.0

[PATCH 08/22] staging: rtl8723bs: Fix indenting problems in hal/HalHWImg8723B_BB.c

[Larry Finger]

Smatch lists the following:

  CHECK   drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c
drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c:314 ODM_ReadAndConfig_MP_8723B_AGC_TAB() warn: for statement not indented
drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c:583 ODM_ReadAndConfig_MP_8723B_PHY_REG() warn: for statement not indented
drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c:586 ODM_ReadAndConfig_MP_8723B_PHY_REG() warn: inconsistent indenting

These were all fixed with white-space changes.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c b/drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c
index b42f06076f93..51d4219177d3 100644
--- a/drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c
+++ b/drivers/staging/rtl8723bs/hal/HalHWImg8723B_BB.c
@@ -312,7 +312,7 @@ void ODM_ReadAndConfig_MP_8723B_AGC_TAB(PDM_ODM_T pDM_Odm)
 				*   Discard the following (offset, data) pairs.
 				*/
 				while (v1 < 0x40000000 && i < ArrayLen-2)
-				READ_NEXT_PAIR(v1, v2, i);
+					READ_NEXT_PAIR(v1, v2, i);
 
 				i -= 2; /*  prevent from for-loop += 2 */
 			} else {
@@ -581,9 +581,9 @@ void ODM_ReadAndConfig_MP_8723B_PHY_REG(PDM_ODM_T pDM_Odm)
 				*   Discard the following (offset, data) pairs.
 				*/
 				while (v1 < 0x40000000 && i < ArrayLen-2)
-				READ_NEXT_PAIR(v1, v2, i);
+					READ_NEXT_PAIR(v1, v2, i);
 
-					i -= 2; /*  prevent from for-loop += 2 */
+				i -= 2; /*  prevent from for-loop += 2 */
 			} else { /*  Configure matched pairs and skip to end of if-else. */
 				while (v1 < 0x40000000 && i < ArrayLen-2) {
 					odm_ConfigBB_PHY_8723B(pDM_Odm, v1, bMaskDWord, v2);
-- 
2.12.0

[PATCH 09/22] staging: rtl8723bs: Fix indening problem in hal/hal_com_phycfg.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
drivers/staging/rtl8723bs/hal/hal_com_phycfg.c:2090 Hal_ChannelPlanToRegulation() warn: inconsistent indenting

This warning is fixed with a white-space change.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/hal/hal_com_phycfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c b/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
index 95fff20e9c4b..566b6f0997da 100644
--- a/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
+++ b/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
@@ -2087,7 +2087,7 @@ void Hal_ChannelPlanToRegulation(struct adapter *Adapter, u16 ChannelPlan)
 	case RT_CHANNEL_DOMAIN_WORLD_FCC2:
 		pHalData->Regulation2_4G = TXPWR_LMT_FCC;
 		pHalData->Regulation5G = TXPWR_LMT_FCC;
-				break;
+		break;
 	case RT_CHANNEL_DOMAIN_WORLD_FCC3:
 		pHalData->Regulation2_4G = TXPWR_LMT_FCC;
 		pHalData->Regulation5G = TXPWR_LMT_FCC;
-- 
2.12.0

[PATCH 10/22] staging: rtl8723bs: Fix indenting problem for hal/hal_com.c

[Larry Finger]

Smatch lists the following:

  CHECK   drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
drivers/staging/rtl8723bs/hal/hal_com_phycfg.c:2090 Hal_ChannelPlanToRegulation() warn: inconsistent indenting

Fixed by changing the white space.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/hal/hal_com.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/rtl8723bs/hal/hal_com.c b/drivers/staging/rtl8723bs/hal/hal_com.c
index 093978d8f2a4..1880d4140bee 100644
--- a/drivers/staging/rtl8723bs/hal/hal_com.c
+++ b/drivers/staging/rtl8723bs/hal/hal_com.c
@@ -1731,11 +1731,11 @@ void rtw_bb_rf_gain_offset(struct adapter *padapter)
 			for (i = 0; i < ArrayLen; i += 2) {
 				v1 = Array[i];
 				v2 = Array[i+1];
-				 if (v1 == padapter->eeprompriv.EEPROMRFGainVal) {
-						DBG_871X("Offset RF Gain. got v1 = 0x%x , v2 = 0x%x\n", v1, v2);
-						target = v2;
-						break;
-				 }
+				if (v1 == padapter->eeprompriv.EEPROMRFGainVal) {
+					DBG_871X("Offset RF Gain. got v1 = 0x%x , v2 = 0x%x\n", v1, v2);
+					target = v2;
+					break;
+				}
 			}
 			DBG_871X("padapter->eeprompriv.EEPROMRFGainVal = 0x%x , Gain offset Target Value = 0x%x\n", padapter->eeprompriv.EEPROMRFGainVal, target);
 			PHY_SetRFReg(padapter, RF_PATH_A, REG_RF_BB_GAIN_OFFSET, BIT18|BIT17|BIT16|BIT15, target);
-- 
2.12.0

[PATCH 11/22] staging: rtl8723bs: Fix indenting problems in core/rtw_xmit.c

[Larry Finger]

Smatch logs the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_xmit.c
drivers/staging/rtl8723bs/core/rtw_xmit.c:277 _rtw_init_xmit_priv() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_xmit.c:294 _rtw_free_xmit_priv() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_xmit.c:295 _rtw_free_xmit_priv() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_xmit.c:946 xmitframe_addmic() warn: inconsistent indenting

These are fixed with white-space changes.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_xmit.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_xmit.c b/drivers/staging/rtl8723bs/core/rtw_xmit.c
index 60585540069a..8f2c9a6658bf 100644
--- a/drivers/staging/rtl8723bs/core/rtw_xmit.c
+++ b/drivers/staging/rtl8723bs/core/rtw_xmit.c
@@ -274,7 +274,7 @@ s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
 	rtw_alloc_hwxmits(padapter);
 	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
 
-  for (i = 0; i < 4; i++) {
+	for (i = 0; i < 4; i++) {
 		pxmitpriv->wmm_para_seq[i] = i;
 	}
 
@@ -290,8 +290,8 @@ s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
 
 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv)
 {
-       int i;
-      struct adapter *padapter = pxmitpriv->adapter;
+	int i;
+	struct adapter *padapter = pxmitpriv->adapter;
 	struct xmit_frame	*pxmitframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
 	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
 
@@ -942,8 +942,8 @@ static s32 xmitframe_addmic(struct adapter *padapter, struct xmit_frame *pxmitfr
 
 			}
 
-      /* if (pqospriv->qos_option == 1) */
-      if (pattrib->qos_en)
+			/* if (pqospriv->qos_option == 1) */
+			if (pattrib->qos_en)
 				priority[0] = (u8)pxmitframe->attrib.priority;
 
 
-- 
2.12.0

[PATCH 12/22] staging: rtl8723bs: Fix possible usage of NULL pointer in core/rtw_debug.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_debug.c
drivers/staging/rtl8723bs/core/rtw_debug.c:454 proc_get_survey_info() error: we previously assumed 'phead' could be null (see line 453)
drivers/staging/rtl8723bs/core/rtw_debug.c:455 proc_get_survey_info() warn: variable dereferenced before check 'phead' (see line 454)

In the code, there are two successive calls to get_head(). The second
is removed.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_debug.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_debug.c b/drivers/staging/rtl8723bs/core/rtw_debug.c
index d34747b29309..51cef55d3f76 100644
--- a/drivers/staging/rtl8723bs/core/rtw_debug.c
+++ b/drivers/staging/rtl8723bs/core/rtw_debug.c
@@ -451,7 +451,6 @@ int proc_get_survey_info(struct seq_file *m, void *v)
 	spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
 	phead = get_list_head(queue);
 	plist = phead ? get_next(phead) : NULL;
-	plist = get_next(phead);
 	if ((!phead) || (!plist)) {
 		spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
 		return 0;
-- 
2.12.0

[PATCH 13/22] staging: rtl8723bs: Fix indenting mistake in core/rtw_ap.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_ap.c
drivers/staging/rtl8723bs/core/rtw_ap.c:382 expire_timeout_chk() warn: inconsistent indenting

Fixing this requires changing the indentatikon of a long for loop.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_ap.c | 99 ++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 52 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c
index 9c71692a3a05..68b750275dff 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -379,70 +379,65 @@ void expire_timeout_chk(struct adapter *padapter)
 
 	spin_unlock_bh(&pstapriv->asoc_list_lock);
 
-if (chk_alive_num) {
+	if (chk_alive_num) {
+		u8 backup_oper_channel = 0;
+		struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+
+		/* switch to correct channel of current network  before issue keep-alive frames */
+		if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
+			backup_oper_channel = rtw_get_oper_ch(padapter);
+			SelectChannel(padapter, pmlmeext->cur_channel);
+		}
 
-	u8 backup_oper_channel = 0;
-	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
-	/* switch to correct channel of current network  before issue keep-alive frames */
-	if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
-		backup_oper_channel = rtw_get_oper_ch(padapter);
-		SelectChannel(padapter, pmlmeext->cur_channel);
-	}
+		/* issue null data to check sta alive*/
+		for (i = 0; i < chk_alive_num; i++) {
+			int ret = _FAIL;
 
-	/* issue null data to check sta alive*/
-	for (i = 0; i < chk_alive_num; i++) {
-		int ret = _FAIL;
+			psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
+			if (!(psta->state & _FW_LINKED))
+				continue;
 
-		psta = rtw_get_stainfo_by_offset(pstapriv, chk_alive_list[i]);
-		if (!(psta->state & _FW_LINKED))
-			continue;
+			if (psta->state & WIFI_SLEEP_STATE)
+				ret = issue_nulldata(padapter, psta->hwaddr, 0, 1, 50);
+			else
+				ret = issue_nulldata(padapter, psta->hwaddr, 0, 3, 50);
 
-		if (psta->state & WIFI_SLEEP_STATE)
-			ret = issue_nulldata(padapter, psta->hwaddr, 0, 1, 50);
-		else
-			ret = issue_nulldata(padapter, psta->hwaddr, 0, 3, 50);
+			psta->keep_alive_trycnt++;
+			if (ret == _SUCCESS) {
+				DBG_871X(
+					"asoc check, sta(" MAC_FMT ") is alive\n",
+					MAC_ARG(psta->hwaddr)
+					);
+				psta->expire_to = pstapriv->expire_to;
+				psta->keep_alive_trycnt = 0;
+				continue;
+			} else if (psta->keep_alive_trycnt <= 3) {
 
-		psta->keep_alive_trycnt++;
-		if (ret == _SUCCESS) {
+				DBG_871X(
+					"ack check for asoc expire, keep_alive_trycnt =%d\n",
+					psta->keep_alive_trycnt);
+				psta->expire_to = 1;
+				continue;
+			}
 
-			DBG_871X(
-				"asoc check, sta(" MAC_FMT ") is alive\n",
-				MAC_ARG(psta->hwaddr)
-			);
-			psta->expire_to = pstapriv->expire_to;
 			psta->keep_alive_trycnt = 0;
-			continue;
-		} else if (psta->keep_alive_trycnt <= 3) {
-
-
 			DBG_871X(
-				"ack check for asoc expire, keep_alive_trycnt =%d\n",
-				psta->keep_alive_trycnt
-			);
-			psta->expire_to = 1;
-			continue;
-		}
-
-		psta->keep_alive_trycnt = 0;
-		DBG_871X(
-			"asoc expire "MAC_FMT", state = 0x%x\n",
-			MAC_ARG(psta->hwaddr),
-			psta->state
-		);
-		spin_lock_bh(&pstapriv->asoc_list_lock);
-		if (list_empty(&psta->asoc_list) == false) {
-			list_del_init(&psta->asoc_list);
-			pstapriv->asoc_list_cnt--;
-			updated = ap_free_sta(padapter, psta, false, WLAN_REASON_DEAUTH_LEAVING);
+				"asoc expire "MAC_FMT", state = 0x%x\n",
+				MAC_ARG(psta->hwaddr),
+				psta->state);
+			spin_lock_bh(&pstapriv->asoc_list_lock);
+			if (list_empty(&psta->asoc_list) == false) {
+				list_del_init(&psta->asoc_list);
+				pstapriv->asoc_list_cnt--;
+				updated = ap_free_sta(padapter, psta, false, WLAN_REASON_DEAUTH_LEAVING);
+			}
+			spin_unlock_bh(&pstapriv->asoc_list_lock);
 		}
-		spin_unlock_bh(&pstapriv->asoc_list_lock);
 
+		if (backup_oper_channel > 0) /* back to the original operation channel */
+			SelectChannel(padapter, backup_oper_channel);
 	}
 
-	if (backup_oper_channel > 0) /* back to the original operation channel */
-		SelectChannel(padapter, backup_oper_channel);
-}
-
 	associated_clients_update(padapter, updated);
 }
 
-- 
2.12.0

Re: [PATCH 13/22] staging: rtl8723bs: Fix indenting mistake in core/rtw_ap.c

[Bastien Nocera]

On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
> Fixing this requires changing the indentatikon of a long for loop.

Typo here.

[PATCH 14/22] staging: rtl8723bs: Fix indenting mistakes in core/rtw_ieee80211.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_ieee80211.c
drivers/staging/rtl8723bs/core/rtw_ieee80211.c:83 rtw_is_cckrates_included() warn: if statement not indented
drivers/staging/rtl8723bs/core/rtw_ieee80211.c:98 rtw_is_cckratesonly_included() warn: if statement not indented

These warnings are fixed with white-space changes.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
index af44a8cd26f8..4670e72368e5 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -81,8 +81,8 @@ uint	rtw_is_cckrates_included(u8 *rate)
 
 		while (rate[i] !=  0) {
 			if  ((((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
-			(((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22))
-			return true;
+			     (((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22))
+				return true;
 			i++;
 		}
 
@@ -95,16 +95,13 @@ uint	rtw_is_cckratesonly_included(u8 *rate)
 
 
 	while (rate[i] != 0) {
-			if  ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
-				(((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
-
+		if  ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
+		     (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
 			return false;
-
-			i++;
+		i++;
 	}
 
 	return true;
-
 }
 
 int rtw_check_network_type(unsigned char *rate, int ratelen, int channel)
-- 
2.12.0

[PATCH 15/22] staging: rtl8723bs: Fix indenting mistakes in core/rtw_mlme.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_mlme.c
drivers/staging/rtl8723bs/core/rtw_mlme.c:862 rtw_survey_event_callback() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme.c:1102 rtw_free_assoc_resources() warn: if statement not indented
drivers/staging/rtl8723bs/core/rtw_mlme.c:1165 rtw_indicate_disconnect() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme.c:2830 rtw_restructure_ht_ie() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme.c:2991 rtw_update_ht_cap() warn: inconsistent indenting

All of there are simple white-space errors. A typo is also fixed.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_mlme.c | 37 +++++++++++++++----------------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme.c b/drivers/staging/rtl8723bs/core/rtw_mlme.c
index c95e0626b522..53755e5b97a6 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -856,7 +856,7 @@ void rtw_survey_event_callback(struct adapter	*adapter, u8 *pbuf)
 
 	/*  lock pmlmepriv->lock when you accessing network_q */
 	if ((check_fwstate(pmlmepriv, _FW_UNDER_LINKING)) == false) {
-	  if (pnetwork->Ssid.Ssid[0] == 0) {
+		if (pnetwork->Ssid.Ssid[0] == 0) {
 			pnetwork->Ssid.SsidLength = 0;
 		}
 		rtw_add_network(adapter, pnetwork);
@@ -1100,8 +1100,7 @@ void rtw_free_assoc_resources(struct adapter *adapter, int lock_scanned_queue)
 	}
 
 	if (lock_scanned_queue)
-
-	adapter->securitypriv.key_mask = 0;
+		adapter->securitypriv.key_mask = 0;
 
 	rtw_reset_rx_info(pdbgpriv);
 }
@@ -1162,7 +1161,7 @@ void rtw_indicate_disconnect(struct adapter *padapter)
 		/* set ips_deny_time to avoid enter IPS before LPS leave */
 		rtw_set_ips_deny(padapter, 3000);
 
-	      _clr_fwstate_(pmlmepriv, _FW_LINKED);
+		_clr_fwstate_(pmlmepriv, _FW_LINKED);
 
 		rtw_clear_scan_deny(padapter);
 	}
@@ -2826,8 +2825,8 @@ unsigned int rtw_restructure_ht_ie(struct adapter *padapter, u8 *in_ie, u8 *out_
 		if (stbc_rx_enable)
 			ht_capie.cap_info |= cpu_to_le16(IEEE80211_HT_CAP_RX_STBC_1R);/* RX STBC One spatial stream */
 
-	    set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_1R);
-			break;
+		set_mcs_rate_by_mask(ht_capie.supp_mcs_set, MCS_RATE_1R);
+		break;
 
 	case RF_2T2R:
 	case RF_1T2R:
@@ -2984,22 +2983,22 @@ void rtw_update_ht_cap(struct adapter *padapter, u8 *pie, uint ie_len, u8 channe
 #else /* CONFIG_DISABLE_MCS13TO15 */
 			set_mcs_rate_by_mask(pmlmeinfo->HT_caps.u.HT_cap_element.MCS_rate, MCS_RATE_2R);
 #endif /* CONFIG_DISABLE_MCS13TO15 */
-	}
+		}
 
-	/* switch to the 40M Hz mode accoring to the AP */
-	/* pmlmeext->cur_bwmode = CHANNEL_WIDTH_40; */
-	switch ((pmlmeinfo->HT_info.infos[0] & 0x3)) {
-	case EXTCHNL_OFFSET_UPPER:
-		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
-		break;
+		/* switch to the 40M Hz mode according to the AP */
+		/* pmlmeext->cur_bwmode = CHANNEL_WIDTH_40; */
+		switch ((pmlmeinfo->HT_info.infos[0] & 0x3)) {
+		case EXTCHNL_OFFSET_UPPER:
+			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
+			break;
 
-	case EXTCHNL_OFFSET_LOWER:
-		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
-		break;
+		case EXTCHNL_OFFSET_LOWER:
+			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
+			break;
 
-	default:
-		pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
-		break;
+		default:
+			pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
+			break;
 		}
 	}
 
-- 
2.12.0

[PATCH 16/22] staging: rtl8723bs: Fix some indenting problems and a potential data overrun

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_wlan_util.c
drivers/staging/rtl8723bs/core/rtw_wlan_util.c:67 cckrates_included() warn: if statement not indented
drivers/staging/rtl8723bs/core/rtw_wlan_util.c:81 cckratesonly_included() warn: if statement not indented
drivers/staging/rtl8723bs/core/rtw_wlan_util.c:815 rtw_camid_alloc() warn: should '1 << (cam_id)' be a 64 bit type?

The first two are fixed with white-space changes. The third is fixed by
restricting cam_id to be less than 32.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index c966241df2ea..f485f541e36d 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -65,8 +65,8 @@ int cckrates_included(unsigned char *rate, int ratelen)
 
 	for (i = 0; i < ratelen; i++) {
 		if  ((((rate[i]) & 0x7f) == 2)	|| (((rate[i]) & 0x7f) == 4) ||
-			   (((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22))
-		return true;
+		     (((rate[i]) & 0x7f) == 11)  || (((rate[i]) & 0x7f) == 22))
+			return true;
 	}
 
 	return false;
@@ -79,8 +79,8 @@ int cckratesonly_included(unsigned char *rate, int ratelen)
 
 	for (i = 0; i < ratelen; i++) {
 		if  ((((rate[i]) & 0x7f) != 2) && (((rate[i]) & 0x7f) != 4) &&
-			   (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
-		return false;
+		     (((rate[i]) & 0x7f) != 11)  && (((rate[i]) & 0x7f) != 22))
+			return false;
 	}
 
 	return true;
@@ -811,7 +811,7 @@ s16 rtw_camid_alloc(struct adapter *adapter, struct sta_info *sta, u8 kid)
 	}
 
 bitmap_handle:
-	if (cam_id >= 0)
+	if (cam_id >= 0 && cam_id < 32)
 		cam_ctl->bitmap |= BIT(cam_id);
 
 	spin_unlock_bh(&cam_ctl->lock);
-- 
2.12.0

Re: [PATCH 16/22] staging: rtl8723bs: Fix some indenting problems and a potential data overrun

[Bastien Nocera]

On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
> +       if (cam_id >= 0 && cam_id < 32)

Isn't there a constant we could use instead of hard-coding this?

[PATCH 17/22] staging: rtl8723bs: Fix indenting problem in core/rtw_sta_mgt.c

[Larry Finger]

Sparse reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_sta_mgt.c
drivers/staging/rtl8723bs/core/rtw_sta_mgt.c:25 _rtw_init_stainfo() warn: inconsistent indenting

This problem is fixed with a white-spcae change.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_sta_mgt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c b/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c
index d7eee6dd7e3b..cb43ec90a648 100644
--- a/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c
+++ b/drivers/staging/rtl8723bs/core/rtw_sta_mgt.c
@@ -22,7 +22,7 @@ void _rtw_init_stainfo(struct sta_info *psta)
 {
 	memset((u8 *)psta, 0, sizeof(struct sta_info));
 
-	 spin_lock_init(&psta->lock);
+	spin_lock_init(&psta->lock);
 	INIT_LIST_HEAD(&psta->list);
 	INIT_LIST_HEAD(&psta->hash_list);
 	/* INIT_LIST_HEAD(&psta->asoc_list); */
-- 
2.12.0

[PATCH 18/22] staging: rtl8723bs: Fix some white-space errors in core/rtw_security.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_security.c
drivers/staging/rtl8723bs/core/rtw_security.c:266 rtw_wep_encrypt() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:433 rtw_seccalctkipmic() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:749 rtw_tkip_encrypt() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:865 rtw_tkip_decrypt() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1383 aes_cipher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1415 aes_cipher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1430 aes_cipher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1582 rtw_aes_encrypt() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1651 aes_decipher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1739 aes_decipher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_security.c:1792 aes_decipher() warn: curly braces intended?
drivers/staging/rtl8723bs/core/rtw_security.c:1809 aes_decipher() warn: inconsistent indenting

All of the above are fixed with white-space changes. A few unneeded
blank lines are deleted.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_security.c | 469 +++++++++++++-------------
 1 file changed, 229 insertions(+), 240 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c
index 698e11e5d0a9..e832f16997b7 100644
--- a/drivers/staging/rtl8723bs/core/rtw_security.c
+++ b/drivers/staging/rtl8723bs/core/rtw_security.c
@@ -262,17 +262,15 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
 				arcfour_encrypt(&mycontext, payload+length, crc, 4);
 
 			} else{
-			length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;
+				length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;
 				*((__le32 *)crc) = getcrc32(payload, length);
 				arcfour_init(&mycontext, wepkey, 3+keylength);
 				arcfour_encrypt(&mycontext, payload, payload, length);
 				arcfour_encrypt(&mycontext, payload+length, crc, 4);
 
-			pframe += pxmitpriv->frag_len;
-			pframe = (u8 *)RND4((SIZE_PTR)(pframe));
-
+				pframe += pxmitpriv->frag_len;
+				pframe = (u8 *)RND4((SIZE_PTR)(pframe));
 			}
-
 		}
 
 		WEP_SW_ENC_CNT_INC(psecuritypriv, pattrib->ra);
@@ -429,7 +427,7 @@ void rtw_seccalctkipmic(u8 *key, u8 *header, u8 *data, u32 data_len, u8 *mic_cod
 
 	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
 	if (header[1]&1) {   /* ToDS == 1 */
-			rtw_secmicappend(&micdata, &header[16], 6);  /* DA */
+		rtw_secmicappend(&micdata, &header[16], 6);  /* DA */
 		if (header[1]&2)  /* From Ds == 1 */
 			rtw_secmicappend(&micdata, &header[24], 6);
 		else
@@ -746,9 +744,8 @@ u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe)
 					arcfour_encrypt(&mycontext, payload, payload, length);
 					arcfour_encrypt(&mycontext, payload+length, crc, 4);
 
-				pframe += pxmitpriv->frag_len;
-				pframe = (u8 *)RND4((SIZE_PTR)(pframe));
-
+					pframe += pxmitpriv->frag_len;
+					pframe = (u8 *)RND4((SIZE_PTR)(pframe));
 				}
 			}
 
@@ -791,10 +788,8 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
 
 	/* 4 start to decrypt recvframe */
 	if (prxattrib->encrypt == _TKIP_) {
-
 		stainfo = rtw_get_stainfo(&padapter->stapriv, &prxattrib->ta[0]);
 		if (stainfo != NULL) {
-
 			if (IS_MCAST(prxattrib->ra)) {
 				static unsigned long start = 0;
 				static u32 no_gkey_bc_cnt = 0;
@@ -860,8 +855,9 @@ u32 rtw_tkip_decrypt(struct adapter *padapter, u8 *precvframe)
 			*((u32 *)crc) = le32_to_cpu(getcrc32(payload, length-4));
 
 			if (crc[3] != payload[length-1] || crc[2] != payload[length-2] || crc[1] != payload[length-3] || crc[0] != payload[length-4]) {
-			    RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
-						crc[3], payload[length-1], crc[2], payload[length-2], crc[1], payload[length-3], crc[0], payload[length-4]));
+				RT_TRACE(_module_rtl871x_security_c_, _drv_err_,
+					 ("rtw_wep_decrypt:icv error crc[3](%x)!=payload[length-1](%x) || crc[2](%x)!=payload[length-2](%x) || crc[1](%x)!=payload[length-3](%x) || crc[0](%x)!=payload[length-4](%x)\n",
+					 crc[3], payload[length-1], crc[2], payload[length-2], crc[1], payload[length-3], crc[0], payload[length-4]));
 				res = _FAIL;
 			}
 
@@ -1375,25 +1371,24 @@ static sint aes_cipher(u8 *key, uint	hdrlen,
 	else
 		a4_exists = 1;
 
-	if (
-		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
-		((frtype|frsubtype) == WIFI_DATA_CFPOLL) ||
-		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL)) {
-			qc_exists = 1;
-					if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
-						hdrlen += 2;
-
-		} else if ((frtype == WIFI_DATA) && /*  add for CONFIG_IEEE80211W, none 11w also can use */
-		((frsubtype == 0x08) ||
-		(frsubtype == 0x09) ||
-		(frsubtype == 0x0a) ||
-		(frsubtype == 0x0b))) {
-			if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
-					hdrlen += 2;
-
-			qc_exists = 1;
-		} else
-			qc_exists = 0;
+	if (((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+	    ((frtype|frsubtype) == WIFI_DATA_CFPOLL) ||
+	    ((frtype|frsubtype) == WIFI_DATA_CFACKPOLL)) {
+		qc_exists = 1;
+		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
+			hdrlen += 2;
+
+	} else if ((frtype == WIFI_DATA) && /*  add for CONFIG_IEEE80211W, none 11w also can use */
+		   ((frsubtype == 0x08) ||
+		   (frsubtype == 0x09) ||
+		   (frsubtype == 0x0a) ||
+		   (frsubtype == 0x0b))) {
+		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN)
+			hdrlen += 2;
+
+		qc_exists = 1;
+	} else
+		qc_exists = 0;
 
 	pn_vector[0] = pframe[hdrlen];
 	pn_vector[1] = pframe[hdrlen+1];
@@ -1410,118 +1405,117 @@ static sint aes_cipher(u8 *key, uint	hdrlen,
 			plen,
 			pn_vector,
 			frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
-		);
-
-		construct_mic_header1(
-			mic_header1,
-			hdrlen,
-			pframe,	/* message */
-			frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
-		);
-		construct_mic_header2(
-			mic_header2,
-			pframe,	/* message, */
-			a4_exists,
-			qc_exists
-		);
+	);
+
+	construct_mic_header1(
+		mic_header1,
+		hdrlen,
+		pframe,	/* message */
+		frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
+	);
+	construct_mic_header2(
+		mic_header2,
+		pframe,	/* message, */
+		a4_exists,
+		qc_exists
+	);
 
 
 	payload_remainder = plen % 16;
-		num_blocks = plen / 16;
+	num_blocks = plen / 16;
 
-		/* Find start of payload */
-		payload_index = (hdrlen + 8);
+	/* Find start of payload */
+	payload_index = (hdrlen + 8);
 
-		/* Calculate MIC */
-		aes128k128d(key, mic_iv, aes_out);
-		bitwise_xor(aes_out, mic_header1, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
-		bitwise_xor(aes_out, mic_header2, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
+	/* Calculate MIC */
+	aes128k128d(key, mic_iv, aes_out);
+	bitwise_xor(aes_out, mic_header1, chain_buffer);
+	aes128k128d(key, chain_buffer, aes_out);
+	bitwise_xor(aes_out, mic_header2, chain_buffer);
+	aes128k128d(key, chain_buffer, aes_out);
 
-		for (i = 0; i < num_blocks; i++) {
-			bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);/* bitwise_xor(aes_out, &message[payload_index], chain_buffer); */
-
-			payload_index += 16;
-			aes128k128d(key, chain_buffer, aes_out);
-		}
+	for (i = 0; i < num_blocks; i++) {
+		bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);/* bitwise_xor(aes_out, &message[payload_index], chain_buffer); */
 
-		/* Add on the final payload block if it needs padding */
-		if (payload_remainder > 0) {
-			for (j = 0; j < 16; j++)
-				padded_buffer[j] = 0x00;
-			for (j = 0; j < payload_remainder; j++) {
-				padded_buffer[j] = pframe[payload_index++];/* padded_buffer[j] = message[payload_index++]; */
-			}
-			bitwise_xor(aes_out, padded_buffer, chain_buffer);
-			aes128k128d(key, chain_buffer, aes_out);
+		payload_index += 16;
+		aes128k128d(key, chain_buffer, aes_out);
+	}
 
+	/* Add on the final payload block if it needs padding */
+	if (payload_remainder > 0) {
+		for (j = 0; j < 16; j++)
+			padded_buffer[j] = 0x00;
+		for (j = 0; j < payload_remainder; j++) {
+			padded_buffer[j] = pframe[payload_index++];/* padded_buffer[j] = message[payload_index++]; */
 		}
+		bitwise_xor(aes_out, padded_buffer, chain_buffer);
+		aes128k128d(key, chain_buffer, aes_out);
 
-		for (j = 0 ; j < 8; j++)
-			mic[j] = aes_out[j];
-
-		/* Insert MIC into payload */
-		for (j = 0; j < 8; j++)
-			pframe[payload_index+j] = mic[j];	/* message[payload_index+j] = mic[j]; */
+	}
 
-		payload_index = hdrlen + 8;
-		for (i = 0; i < num_blocks; i++) {
-			construct_ctr_preload(
-				ctr_preload,
-				a4_exists,
-				qc_exists,
-				pframe,	/* message, */
-				pn_vector,
-				i+1,
-				frtype
-			); /*  add for CONFIG_IEEE80211W, none 11w also can use */
-			aes128k128d(key, ctr_preload, aes_out);
-			bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);/* bitwise_xor(aes_out, &message[payload_index], chain_buffer); */
-			for (j = 0; j < 16; j++)
-				pframe[payload_index++] = chain_buffer[j];/* for (j = 0; j<16;j++) message[payload_index++] = chain_buffer[j]; */
-		}
+	for (j = 0 ; j < 8; j++)
+		mic[j] = aes_out[j];
 
-		if (payload_remainder > 0) {
-			/* If there is a short final block, then pad it,*/
-			/* encrypt it and copy the unpadded part back   */
-			construct_ctr_preload(
-				ctr_preload,
-				a4_exists,
-				qc_exists,
-				pframe,	/* message, */
-				pn_vector,
-				num_blocks+1,
-				frtype
-			); /*  add for CONFIG_IEEE80211W, none 11w also can use */
+	/* Insert MIC into payload */
+	for (j = 0; j < 8; j++)
+		pframe[payload_index+j] = mic[j];	/* message[payload_index+j] = mic[j]; */
 
-			for (j = 0; j < 16; j++)
-				padded_buffer[j] = 0x00;
-			for (j = 0; j < payload_remainder; j++) {
-				padded_buffer[j] = pframe[payload_index+j];/* padded_buffer[j] = message[payload_index+j]; */
-			}
-			aes128k128d(key, ctr_preload, aes_out);
-			bitwise_xor(aes_out, padded_buffer, chain_buffer);
-			for (j = 0; j < payload_remainder; j++)
-				pframe[payload_index++] = chain_buffer[j];/* for (j = 0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j]; */
-		}
+	payload_index = hdrlen + 8;
+	for (i = 0; i < num_blocks; i++) {
+		construct_ctr_preload(
+			ctr_preload,
+			a4_exists,
+			qc_exists,
+			pframe,	/* message, */
+			pn_vector,
+			i+1,
+			frtype
+		); /*  add for CONFIG_IEEE80211W, none 11w also can use */
+		aes128k128d(key, ctr_preload, aes_out);
+		bitwise_xor(aes_out, &pframe[payload_index], chain_buffer);/* bitwise_xor(aes_out, &message[payload_index], chain_buffer); */
+		for (j = 0; j < 16; j++)
+			pframe[payload_index++] = chain_buffer[j];/* for (j = 0; j<16;j++) message[payload_index++] = chain_buffer[j]; */
+	}
 
-		/* Encrypt the MIC */
+	if (payload_remainder > 0) {
+		/* If there is a short final block, then pad it,*/
+		/* encrypt it and copy the unpadded part back   */
 		construct_ctr_preload(
 			ctr_preload,
 			a4_exists,
 			qc_exists,
 			pframe,	/* message, */
 			pn_vector,
-			0,
+			num_blocks+1,
 			frtype
 		); /*  add for CONFIG_IEEE80211W, none 11w also can use */
 
 		for (j = 0; j < 16; j++)
 			padded_buffer[j] = 0x00;
-		for (j = 0; j < 8; j++) {
-			padded_buffer[j] = pframe[j+hdrlen+8+plen];/* padded_buffer[j] = message[j+hdrlen+8+plen]; */
-		}
+		for (j = 0; j < payload_remainder; j++)
+			padded_buffer[j] = pframe[payload_index+j];/* padded_buffer[j] = message[payload_index+j]; */
+
+		aes128k128d(key, ctr_preload, aes_out);
+		bitwise_xor(aes_out, padded_buffer, chain_buffer);
+		for (j = 0; j < payload_remainder; j++)
+			pframe[payload_index++] = chain_buffer[j];/* for (j = 0; j<payload_remainder;j++) message[payload_index++] = chain_buffer[j]; */
+	}
+
+	/* Encrypt the MIC */
+	construct_ctr_preload(
+		ctr_preload,
+		a4_exists,
+		qc_exists,
+		pframe,	/* message, */
+		pn_vector,
+		0,
+		frtype
+	); /*  add for CONFIG_IEEE80211W, none 11w also can use */
+
+	for (j = 0; j < 16; j++)
+		padded_buffer[j] = 0x00;
+	for (j = 0; j < 8; j++)
+		padded_buffer[j] = pframe[j+hdrlen+8+plen];/* padded_buffer[j] = message[j+hdrlen+8+plen]; */
 
 	aes128k128d(key, ctr_preload, aes_out);
 	bitwise_xor(aes_out, padded_buffer, chain_buffer);
@@ -1570,7 +1564,6 @@ u32 rtw_aes_encrypt(struct adapter *padapter, u8 *pxmitframe)
 		prwskeylen = 16;
 
 		for (curfragnum = 0; curfragnum < pattrib->nr_frags; curfragnum++) {
-
 			if ((curfragnum+1) == pattrib->nr_frags) {	/* 4 the last fragment */
 				length = pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;
 
@@ -1579,9 +1572,8 @@ u32 rtw_aes_encrypt(struct adapter *padapter, u8 *pxmitframe)
 				length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-pattrib->icv_len;
 
 				aes_cipher(prwskey, pattrib->hdrlen, pframe, length);
-			pframe += pxmitpriv->frag_len;
-			pframe = (u8 *)RND4((SIZE_PTR)(pframe));
-
+				pframe += pxmitpriv->frag_len;
+				pframe = (u8 *)RND4((SIZE_PTR)(pframe));
 			}
 		}
 
@@ -1643,27 +1635,24 @@ static sint aes_decipher(u8 *key, uint	hdrlen,
 	else
 		a4_exists = 1;
 
-	if (
-		((frtype|frsubtype) == WIFI_DATA_CFACK) ||
-		((frtype|frsubtype) == WIFI_DATA_CFPOLL) ||
-		((frtype|frsubtype) == WIFI_DATA_CFACKPOLL)) {
-			qc_exists = 1;
-					if (hdrlen !=  WLAN_HDR_A3_QOS_LEN) {
-
-					hdrlen += 2;
-			}
-		} else if ((frtype == WIFI_DATA) && /* only for data packet . add for CONFIG_IEEE80211W, none 11w also can use */
-		((frsubtype == 0x08) ||
-		(frsubtype == 0x09) ||
-		(frsubtype == 0x0a) ||
-		(frsubtype == 0x0b))) {
-			if (hdrlen !=  WLAN_HDR_A3_QOS_LEN) {
-
-					hdrlen += 2;
-			}
-			qc_exists = 1;
-		} else
-			qc_exists = 0;
+	if (((frtype|frsubtype) == WIFI_DATA_CFACK) ||
+	    ((frtype|frsubtype) == WIFI_DATA_CFPOLL) ||
+	    ((frtype|frsubtype) == WIFI_DATA_CFACKPOLL)) {
+		qc_exists = 1;
+		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN) {
+			hdrlen += 2;
+		}
+	} else if ((frtype == WIFI_DATA) && /* only for data packet . add for CONFIG_IEEE80211W, none 11w also can use */
+		   ((frsubtype == 0x08) ||
+		   (frsubtype == 0x09) ||
+		   (frsubtype == 0x0a) ||
+		   (frsubtype == 0x0b))) {
+		if (hdrlen !=  WLAN_HDR_A3_QOS_LEN) {
+			hdrlen += 2;
+		}
+		qc_exists = 1;
+	} else
+		qc_exists = 0;
 
 
 	/*  now, decrypt pframe with hdrlen offset and plen long */
@@ -1727,138 +1716,138 @@ static sint aes_decipher(u8 *key, uint	hdrlen,
 
 
 	construct_mic_iv(
-			mic_iv,
-			qc_exists,
-			a4_exists,
-			message,
-			plen-8,
-			pn_vector,
-			frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
-		);
+		mic_iv,
+		qc_exists,
+		a4_exists,
+		message,
+		plen-8,
+		pn_vector,
+		frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
+	);
+
+	construct_mic_header1(
+		mic_header1,
+		hdrlen,
+		message,
+		frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
+	);
+	construct_mic_header2(
+		mic_header2,
+		message,
+		a4_exists,
+		qc_exists
+	);
 
-		construct_mic_header1(
-			mic_header1,
-			hdrlen,
-			message,
-			frtype /*  add for CONFIG_IEEE80211W, none 11w also can use */
-		);
-		construct_mic_header2(
-			mic_header2,
-			message,
-			a4_exists,
-			qc_exists
-		);
 
+	payload_remainder = (plen-8) % 16;
+	num_blocks = (plen-8) / 16;
 
-		payload_remainder = (plen-8) % 16;
-		num_blocks = (plen-8) / 16;
+	/* Find start of payload */
+	payload_index = (hdrlen + 8);
 
-		/* Find start of payload */
-		payload_index = (hdrlen + 8);
+	/* Calculate MIC */
+	aes128k128d(key, mic_iv, aes_out);
+	bitwise_xor(aes_out, mic_header1, chain_buffer);
+	aes128k128d(key, chain_buffer, aes_out);
+	bitwise_xor(aes_out, mic_header2, chain_buffer);
+	aes128k128d(key, chain_buffer, aes_out);
 
-		/* Calculate MIC */
-		aes128k128d(key, mic_iv, aes_out);
-		bitwise_xor(aes_out, mic_header1, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
-		bitwise_xor(aes_out, mic_header2, chain_buffer);
-		aes128k128d(key, chain_buffer, aes_out);
+	for (i = 0; i < num_blocks; i++) {
+		bitwise_xor(aes_out, &message[payload_index], chain_buffer);
 
-		for (i = 0; i < num_blocks; i++) {
-			bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+		payload_index += 16;
+		aes128k128d(key, chain_buffer, aes_out);
+	}
 
-			payload_index += 16;
-			aes128k128d(key, chain_buffer, aes_out);
+	/* Add on the final payload block if it needs padding */
+	if (payload_remainder > 0) {
+		for (j = 0; j < 16; j++)
+			padded_buffer[j] = 0x00;
+		for (j = 0; j < payload_remainder; j++) {
+			padded_buffer[j] = message[payload_index++];
 		}
+		bitwise_xor(aes_out, padded_buffer, chain_buffer);
+		aes128k128d(key, chain_buffer, aes_out);
 
-		/* Add on the final payload block if it needs padding */
-		if (payload_remainder > 0) {
-			for (j = 0; j < 16; j++)
-				padded_buffer[j] = 0x00;
-			for (j = 0; j < payload_remainder; j++) {
-				padded_buffer[j] = message[payload_index++];
-			}
-			bitwise_xor(aes_out, padded_buffer, chain_buffer);
-			aes128k128d(key, chain_buffer, aes_out);
-
-		}
+	}
 
-		for (j = 0; j < 8; j++)
-			mic[j] = aes_out[j];
+	for (j = 0; j < 8; j++)
+		mic[j] = aes_out[j];
 
-		/* Insert MIC into payload */
-		for (j = 0; j < 8; j++)
-	message[payload_index+j] = mic[j];
+	/* Insert MIC into payload */
+	for (j = 0; j < 8; j++)
+		message[payload_index+j] = mic[j];
 
 	payload_index = hdrlen + 8;
 	for (i = 0; i < num_blocks; i++) {
-			construct_ctr_preload(
-				ctr_preload,
-				a4_exists,
-				qc_exists,
-				message,
-				pn_vector,
-				i+1,
-				frtype
-			); /*  add for CONFIG_IEEE80211W, none 11w also can use */
-			aes128k128d(key, ctr_preload, aes_out);
-			bitwise_xor(aes_out, &message[payload_index], chain_buffer);
-			for (j = 0; j < 16; j++)
-				message[payload_index++] = chain_buffer[j];
-		}
-
-		if (payload_remainder > 0) {
-			/* If there is a short final block, then pad it,*/
-			/* encrypt it and copy the unpadded part back   */
-			construct_ctr_preload(
-				ctr_preload,
-				a4_exists,
-				qc_exists,
-				message,
-				pn_vector,
-				num_blocks+1,
-				frtype
-			); /*  add for CONFIG_IEEE80211W, none 11w also can use */
-
-			for (j = 0; j < 16; j++)
-				padded_buffer[j] = 0x00;
-			for (j = 0; j < payload_remainder; j++) {
-				padded_buffer[j] = message[payload_index+j];
-			}
-			aes128k128d(key, ctr_preload, aes_out);
-			bitwise_xor(aes_out, padded_buffer, chain_buffer);
-			for (j = 0; j < payload_remainder; j++)
-				message[payload_index++] = chain_buffer[j];
-		}
+		construct_ctr_preload(
+			ctr_preload,
+			a4_exists,
+			qc_exists,
+			message,
+			pn_vector,
+			i+1,
+			frtype
+		); /*  add for CONFIG_IEEE80211W, none 11w also can use */
+		aes128k128d(key, ctr_preload, aes_out);
+		bitwise_xor(aes_out, &message[payload_index], chain_buffer);
+		for (j = 0; j < 16; j++)
+			message[payload_index++] = chain_buffer[j];
+	}
 
-		/* Encrypt the MIC */
+	if (payload_remainder > 0) {
+		/* If there is a short final block, then pad it,*/
+		/* encrypt it and copy the unpadded part back   */
 		construct_ctr_preload(
 			ctr_preload,
 			a4_exists,
 			qc_exists,
 			message,
 			pn_vector,
-			0,
+			num_blocks+1,
 			frtype
 		); /*  add for CONFIG_IEEE80211W, none 11w also can use */
 
 		for (j = 0; j < 16; j++)
 			padded_buffer[j] = 0x00;
-		for (j = 0; j < 8; j++) {
-			padded_buffer[j] = message[j+hdrlen+8+plen-8];
+		for (j = 0; j < payload_remainder; j++) {
+			padded_buffer[j] = message[payload_index+j];
 		}
-
 		aes128k128d(key, ctr_preload, aes_out);
 		bitwise_xor(aes_out, padded_buffer, chain_buffer);
-		for (j = 0; j < 8; j++)
+		for (j = 0; j < payload_remainder; j++)
 			message[payload_index++] = chain_buffer[j];
+	}
+
+	/* Encrypt the MIC */
+	construct_ctr_preload(
+		ctr_preload,
+		a4_exists,
+		qc_exists,
+		message,
+		pn_vector,
+		0,
+		frtype
+	); /*  add for CONFIG_IEEE80211W, none 11w also can use */
+
+	for (j = 0; j < 16; j++)
+		padded_buffer[j] = 0x00;
+	for (j = 0; j < 8; j++) {
+		padded_buffer[j] = message[j+hdrlen+8+plen-8];
+	}
+
+	aes128k128d(key, ctr_preload, aes_out);
+	bitwise_xor(aes_out, padded_buffer, chain_buffer);
+	for (j = 0; j < 8; j++)
+		message[payload_index++] = chain_buffer[j];
 
 	/* compare the mic */
 	for (i = 0; i < 8; i++) {
 		if (pframe[hdrlen+8+plen-8+i] != message[hdrlen+8+plen-8+i]) {
 			RT_TRACE(_module_rtl871x_security_c_, _drv_err_, ("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x)\n",
-						i, pframe[hdrlen+8+plen-8+i], message[hdrlen+8+plen-8+i]));
+					i, pframe[hdrlen+8+plen-8+i], message[hdrlen+8+plen-8+i]));
 			DBG_871X("aes_decipher:mic check error mic[%d]: pframe(%x) != message(%x)\n",
-						i, pframe[hdrlen+8+plen-8+i], message[hdrlen+8+plen-8+i]);
+					i, pframe[hdrlen+8+plen-8+i], message[hdrlen+8+plen-8+i]);
 			res = _FAIL;
 		}
 	}
-- 
2.12.0

[PATCH 19/22] staging: rtl8723bs: Fix white-space errors in core/rtw_recv.c

[Larry Finger]

Smart reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_recv.c
drivers/staging/rtl8723bs/core/rtw_recv.c:598 portctrl() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_recv.c:838 sta2sta_data_frame() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_recv.c:1547 validate_recv_frame() warn: inconsistent indenting

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_recv.c | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_recv.c b/drivers/staging/rtl8723bs/core/rtw_recv.c
index 864538e8299d..6e98a1bd3e77 100644
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -595,7 +595,7 @@ union recv_frame *portctrl(struct adapter *adapter, union recv_frame *precv_fram
 			memcpy(&be_tmp, ptr, 2);
 			ether_type = ntohs(be_tmp);
 
-		  if (ether_type == eapol_type)
+			if (ether_type == eapol_type)
 				prtnframe = precv_frame;
 			else {
 				/* free this frame */
@@ -827,17 +827,14 @@ sint sta2sta_data_frame(
 		sta_addr = pattrib->src;
 
 	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) {
-		{
-			/*  For Station mode, sa and bssid should always be BSSID, and DA is my mac-address */
-			if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN)) {
-				RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("bssid != TA under STATION_MODE; drop pkt\n"));
-				ret = _FAIL;
-				goto exit;
-			}
-
-		sta_addr = pattrib->bssid;
+		/*  For Station mode, sa and bssid should always be BSSID, and DA is my mac-address */
+		if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN)) {
+			RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("bssid != TA under STATION_MODE; drop pkt\n"));
+			ret = _FAIL;
+			goto exit;
 		}
 
+		sta_addr = pattrib->bssid;
 	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) {
 		if (bmcast) {
 			/*  For AP mode, if DA == MCAST, then BSSID should be also MCAST */
@@ -1517,6 +1514,7 @@ sint validate_recv_frame(struct adapter *adapter, union recv_frame *precv_frame)
 	u8 type;
 	u8 subtype;
 	sint retval = _SUCCESS;
+	u8 bDumpRxPkt;
 
 	struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
 
@@ -1544,8 +1542,6 @@ sint validate_recv_frame(struct adapter *adapter, union recv_frame *precv_frame)
 	pattrib->mdata = GetMData(ptr);
 	pattrib->privacy = GetPrivacy(ptr);
 	pattrib->order = GetOrder(ptr);
-{
-	u8 bDumpRxPkt;
 	rtw_hal_get_def_var(adapter, HAL_DEF_DBG_DUMP_RXPKT, &(bDumpRxPkt));
 	if (bDumpRxPkt == 1) /* dump all rx packets */
 		dump_rx_packet(ptr);
@@ -1553,7 +1549,6 @@ sint validate_recv_frame(struct adapter *adapter, union recv_frame *precv_frame)
 		dump_rx_packet(ptr);
 	else if ((bDumpRxPkt == 3) && (type == WIFI_DATA_TYPE))
 		dump_rx_packet(ptr);
-}
 
 	switch (type) {
 	case WIFI_MGT_TYPE: /* mgnt */
-- 
2.12.0

[PATCH 20/22] staging rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c

[Larry Finger]

Smatch lists the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:525 _mgt_dispatcher() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:1595 OnAssocReq() error: buffer overflow 'pstapriv->sta_aid' 32 <= 32
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:2391 dump_mgntframe_and_wait() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:2420 dump_mgntframe_and_wait_ack() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:4969 process_80211d() error: testing array offset 'i' after use.
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:5738 linked_status_chk() warn: inconsistent indenting
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:6459 sitesurvey_cmd_hdl() warn: inconsistent indenting

The indenting problems were fixed with white-space changes. The error at
line 1595 was the result of an off-by-one error in a for loop. The error
at line 4969 was not fixed as that code lies inside a block of code that
only is needed for 5G channels. This chip only works at 2.4 GHz.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
index e0a3cd64777f..18e78d5198c3 100644
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -522,15 +522,14 @@ static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptabl
 	u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 	u8 *pframe = precv_frame->u.hdr.rx_data;
 
-	  if (ptable->func) {
-		 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
-			if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
-				memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
-				return;
-
-			ptable->func(padapter, precv_frame);
-		}
+	if (ptable->func) {
+		/* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
+		if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
+		    memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
+			return;
 
+		ptable->func(padapter, precv_frame);
+	}
 }
 
 void mgt_dispatcher(struct adapter *padapter, union recv_frame *precv_frame)
@@ -1575,7 +1574,7 @@ unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
 	if (pstat->aid > 0) {
 		DBG_871X("  old AID %d\n", pstat->aid);
 	} else {
-		for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
+		for (pstat->aid = 1; pstat->aid < NUM_STA; pstat->aid++)
 			if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
 				break;
 
@@ -2388,7 +2387,7 @@ s32 dump_mgntframe_and_wait(struct adapter *padapter, struct xmit_frame *pmgntfr
 	pxmitbuf->sctx = NULL;
 	spin_unlock_irqrestore(&pxmitpriv->lock_sctx, irqL);
 
-	 return ret;
+	return ret;
 }
 
 s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmgntframe)
@@ -2417,7 +2416,7 @@ s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmg
 		mutex_unlock(&pxmitpriv->ack_tx_mutex);
 	}
 
-	 return ret;
+	return ret;
 }
 
 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
@@ -5735,7 +5734,7 @@ void linked_status_chk(struct adapter *padapter)
 		#else
 		rx_chk_limit = 8;
 		#endif
-			link_count_limit = 7; /*  16 sec */
+		link_count_limit = 7; /*  16 sec */
 
 		/*  Marked by Kurt 20130715 */
 		/*  For WiDi 3.5 and latered on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly. */
@@ -6456,7 +6455,7 @@ u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
 		Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
 
 		/* config the initial gain under scaning, need to write the BB registers */
-			initialgain = 0x1e;
+		initialgain = 0x1e;
 
 		rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
 
-- 
2.12.0

Re: [PATCH 20/22] staging rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c

[Bastien Nocera]

On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
>         } else {
> -               for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
> +               for (pstat->aid = 1; pstat->aid < NUM_STA; pstat->aid++)
>                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
>                                 break;

why not start at 0 and increment pstat->aid afterwards? Meh.

[PATCH 21/22] staging: rtl8723bs: Fix indenting problems in core/rtw_odm.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_odm.c
drivers/staging/rtl8723bs/core/rtw_odm.c:109 rtw_odm_dbg_comp_msg() warn: if statement not indented
drivers/staging/rtl8723bs/core/rtw_odm.c:146 rtw_odm_ability_msg() warn: if statement not indented

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_odm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_odm.c b/drivers/staging/rtl8723bs/core/rtw_odm.c
index 5bc573386ad1..3144e8ec2fa2 100644
--- a/drivers/staging/rtl8723bs/core/rtw_odm.c
+++ b/drivers/staging/rtl8723bs/core/rtw_odm.c
@@ -107,8 +107,9 @@ void rtw_odm_dbg_comp_msg(void *sel, struct adapter *adapter)
 	DBG_871X_SEL_NL(sel, "odm.DebugComponents = 0x%016llx\n", dbg_comp);
 	for (i = 0; i < RTW_ODM_COMP_MAX; i++) {
 		if (odm_comp_str[i])
-		DBG_871X_SEL_NL(sel, "%cBIT%-2d %s\n",
-			(BIT0 << i) & dbg_comp ? '+' : ' ', i, odm_comp_str[i]);
+			DBG_871X_SEL_NL(sel, "%cBIT%-2d %s\n",
+					(BIT0 << i) & dbg_comp ? '+' : ' ',
+					i, odm_comp_str[i]);
 	}
 }
 
@@ -144,8 +145,9 @@ void rtw_odm_ability_msg(void *sel, struct adapter *adapter)
 	DBG_871X_SEL_NL(sel, "odm.SupportAbility = 0x%08x\n", ability);
 	for (i = 0; i < RTW_ODM_ABILITY_MAX; i++) {
 		if (odm_ability_str[i])
-		DBG_871X_SEL_NL(sel, "%cBIT%-2d %s\n",
-			(BIT0 << i) & ability ? '+' : ' ', i, odm_ability_str[i]);
+			DBG_871X_SEL_NL(sel, "%cBIT%-2d %s\n",
+					(BIT0 << i) & ability ? '+' : ' ', i,
+					odm_ability_str[i]);
 	}
 }
 
-- 
2.12.0

[PATCH 22/22] staging: rtl8723bs: Fix indenting error in core/rtw_pwrctrl.c

[Larry Finger]

Smatch reports the following:

  CHECK   drivers/staging/rtl8723bs/core/rtw_pwrctrl.c
drivers/staging/rtl8723bs/core/rtw_pwrctrl.c:641 LeaveAllPowerSaveModeDirect() warn: inconsistent indenting

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
---
 drivers/staging/rtl8723bs/core/rtw_pwrctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8723bs/core/rtw_pwrctrl.c b/drivers/staging/rtl8723bs/core/rtw_pwrctrl.c
index c5dd794dac4b..f708dbf5bfd4 100644
--- a/drivers/staging/rtl8723bs/core/rtw_pwrctrl.c
+++ b/drivers/staging/rtl8723bs/core/rtw_pwrctrl.c
@@ -638,7 +638,7 @@ void LeaveAllPowerSaveModeDirect(struct adapter *Adapter)
 
 		rtw_set_rpwm(Adapter, PS_STATE_S4);
 
-	up(&pwrpriv->lock);
+		up(&pwrpriv->lock);
 
 		rtw_lps_ctrl_wk_cmd(pri_padapter, LPS_CTRL_LEAVE, 0);
 	} else{
-- 
2.12.0

Re: [PATCH 00/22] staging: rtl87232bs: Fix errors and warnings detected by Smatch

[Bastien Nocera]

On Sat, 2017-04-08 at 11:07 -0500, Larry Finger wrote:
> A number of routines have indenting, off by one, and possible usage
> while null warnings or errors listed by Smatch. This set of patches
> fix all but one of these, and it is in code that will be removed in a
> subsequent patch.
> 
> Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>

Feel free to add:
Reviewed-by: Bastien Nocera <hadess@hadess.net>
for all the patches I didn't directly comment on.

Cheers