This patch changes gdm_usb_send() and gdm_sdio_send() to return -EINVAL instead
of calling BUG_ON if an invalid data length is passed to the functions.
Reported-by: Dan Carpenter <[email protected]>
Reported-by: Michalis Pappas <[email protected]>
Signed-off-by: Ben Chan <[email protected]>
---
drivers/staging/gdm72xx/gdm_sdio.c | 3 ++-
drivers/staging/gdm72xx/gdm_usb.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/gdm72xx/gdm_sdio.c b/drivers/staging/gdm72xx/gdm_sdio.c
index 0c6a3eb..9d2de6f 100644
--- a/drivers/staging/gdm72xx/gdm_sdio.c
+++ b/drivers/staging/gdm72xx/gdm_sdio.c
@@ -390,7 +390,8 @@ static int gdm_sdio_send(void *priv_dev, void *data, int len,
u16 cmd_evt;
unsigned long flags;
- BUG_ON(len > TX_BUF_SIZE - TYPE_A_HEADER_SIZE);
+ if (len > TX_BUF_SIZE - TYPE_A_HEADER_SIZE)
+ return -EINVAL;
spin_lock_irqsave(&tx->lock, flags);
diff --git a/drivers/staging/gdm72xx/gdm_usb.c b/drivers/staging/gdm72xx/gdm_usb.c
index cd8e6e4..971976c 100644
--- a/drivers/staging/gdm72xx/gdm_usb.c
+++ b/drivers/staging/gdm72xx/gdm_usb.c
@@ -312,7 +312,8 @@ static int gdm_usb_send(void *priv_dev, void *data, int len,
return -ENODEV;
}
- BUG_ON(len > TX_BUF_SIZE - padding - 1);
+ if (len > TX_BUF_SIZE - padding - 1)
+ return -EINVAL;
spin_lock_irqsave(&tx->lock, flags);
--
2.0.0.526.g5318336
This patch addresses the following issues:
- Use int instead of u32 whenever makes sense
- Turn extract_qos_list() in gdm_qos.c, which previously always returned
0, into a void function.
Reported-by: Dan Carpenter <[email protected]>
Reported-by: Michalis Pappas <[email protected]>
Signed-off-by: Ben Chan <[email protected]>
---
drivers/staging/gdm72xx/gdm_qos.c | 15 +++++++--------
drivers/staging/gdm72xx/gdm_qos.h | 6 +++---
2 files changed, 10 insertions(+), 11 deletions(-)
diff --git a/drivers/staging/gdm72xx/gdm_qos.c b/drivers/staging/gdm72xx/gdm_qos.c
index 732f009..a2efc5c 100644
--- a/drivers/staging/gdm72xx/gdm_qos.c
+++ b/drivers/staging/gdm72xx/gdm_qos.c
@@ -142,7 +142,7 @@ void gdm_qos_release_list(void *nic_ptr)
free_qos_entry_list(&free_list);
}
-static u32 chk_ipv4_rule(struct gdm_wimax_csr_s *csr, u8 *stream, u8 *port)
+static int chk_ipv4_rule(struct gdm_wimax_csr_s *csr, u8 *stream, u8 *port)
{
int i;
@@ -188,9 +188,9 @@ static u32 chk_ipv4_rule(struct gdm_wimax_csr_s *csr, u8 *stream, u8 *port)
return 0;
}
-static u32 get_qos_index(struct nic *nic, u8 *iph, u8 *tcpudph)
+static int get_qos_index(struct nic *nic, u8 *iph, u8 *tcpudph)
{
- u32 IP_ver, i;
+ int IP_ver, i;
struct qos_cb_s *qcb = &nic->qos;
if (iph == NULL || tcpudph == NULL)
@@ -213,7 +213,7 @@ static u32 get_qos_index(struct nic *nic, u8 *iph, u8 *tcpudph)
return -1;
}
-static u32 extract_qos_list(struct nic *nic, struct list_head *head)
+static void extract_qos_list(struct nic *nic, struct list_head *head)
{
struct qos_cb_s *qcb = &nic->qos;
struct qos_entry_s *entry;
@@ -238,8 +238,6 @@ static u32 extract_qos_list(struct nic *nic, struct list_head *head)
if (!list_empty(&qcb->qos_list[i]))
netdev_warn(nic->netdev, "Index(%d) is piled!!\n", i);
}
-
- return 0;
}
static void send_qos_list(struct nic *nic, struct list_head *head)
@@ -305,7 +303,7 @@ out:
return ret;
}
-static u32 get_csr(struct qos_cb_s *qcb, u32 SFID, int mode)
+static int get_csr(struct qos_cb_s *qcb, u32 SFID, int mode)
{
int i;
@@ -333,7 +331,8 @@ static u32 get_csr(struct qos_cb_s *qcb, u32 SFID, int mode)
void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
{
struct nic *nic = nic_ptr;
- u32 i, SFID, index, pos;
+ int i, index, pos;
+ u32 SFID;
u8 sub_cmd_evt;
struct qos_cb_s *qcb = &nic->qos;
struct qos_entry_s *entry, *n;
diff --git a/drivers/staging/gdm72xx/gdm_qos.h b/drivers/staging/gdm72xx/gdm_qos.h
index 50aa191..ab03d33 100644
--- a/drivers/staging/gdm72xx/gdm_qos.h
+++ b/drivers/staging/gdm72xx/gdm_qos.h
@@ -59,11 +59,11 @@ struct qos_entry_s {
struct qos_cb_s {
struct list_head qos_list[QOS_MAX];
- u32 qos_list_cnt;
- u32 qos_null_idx;
+ int qos_list_cnt;
+ int qos_null_idx;
struct gdm_wimax_csr_s csr[QOS_MAX];
spinlock_t qos_lock;
- u32 qos_limit_size;
+ int qos_limit_size;
};
void gdm_qos_init(void *nic_ptr);
--
2.0.0.526.g5318336
Signed-off-by: Ben Chan <[email protected]>
---
drivers/staging/gdm72xx/gdm_qos.c | 10 +++++-----
drivers/staging/gdm72xx/gdm_qos.h | 4 +---
2 files changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/staging/gdm72xx/gdm_qos.c b/drivers/staging/gdm72xx/gdm_qos.c
index df6f000..732f009 100644
--- a/drivers/staging/gdm72xx/gdm_qos.c
+++ b/drivers/staging/gdm72xx/gdm_qos.c
@@ -100,7 +100,7 @@ void gdm_qos_init(void *nic_ptr)
for (i = 0; i < QOS_MAX; i++) {
INIT_LIST_HEAD(&qcb->qos_list[i]);
qcb->csr[i].qos_buf_count = 0;
- qcb->csr[i].enabled = 0;
+ qcb->csr[i].enabled = false;
}
qcb->qos_list_cnt = 0;
@@ -127,7 +127,7 @@ void gdm_qos_release_list(void *nic_ptr)
for (i = 0; i < QOS_MAX; i++) {
qcb->csr[i].qos_buf_count = 0;
- qcb->csr[i].enabled = 0;
+ qcb->csr[i].enabled = false;
}
qcb->qos_list_cnt = 0;
@@ -316,8 +316,8 @@ static u32 get_csr(struct qos_cb_s *qcb, u32 SFID, int mode)
if (mode) {
for (i = 0; i < QOS_MAX; i++) {
- if (qcb->csr[i].enabled == 0) {
- qcb->csr[i].enabled = 1;
+ if (!qcb->csr[i].enabled) {
+ qcb->csr[i].enabled = true;
qcb->qos_list_cnt++;
return i;
}
@@ -428,7 +428,7 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
INIT_LIST_HEAD(&free_list);
spin_lock_irqsave(&qcb->qos_lock, flags);
- qcb->csr[index].enabled = 0;
+ qcb->csr[index].enabled = false;
qcb->qos_list_cnt--;
qcb->qos_limit_size = 254/qcb->qos_list_cnt;
diff --git a/drivers/staging/gdm72xx/gdm_qos.h b/drivers/staging/gdm72xx/gdm_qos.h
index 6543cff..50aa191 100644
--- a/drivers/staging/gdm72xx/gdm_qos.h
+++ b/drivers/staging/gdm72xx/gdm_qos.h
@@ -18,8 +18,6 @@
#include <linux/usb.h>
#include <linux/list.h>
-#define BOOLEAN u8
-
#define QOS_MAX 16
#define IPTYPEOFSERVICE 0x8000
#define PROTOCOL 0x4000
@@ -34,7 +32,7 @@
#define IEEE802_1QVLANID 0x10
struct gdm_wimax_csr_s {
- BOOLEAN enabled;
+ bool enabled;
u32 SFID;
u8 qos_buf_count;
u16 classifier_rule_en;
--
2.0.0.526.g5318336
Signed-off-by: Ben Chan <[email protected]>
---
drivers/staging/gdm72xx/gdm_qos.c | 38 +++++++++++++++++++-------------------
drivers/staging/gdm72xx/gdm_qos.h | 2 +-
2 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/drivers/staging/gdm72xx/gdm_qos.c b/drivers/staging/gdm72xx/gdm_qos.c
index a2efc5c..b08c8e1 100644
--- a/drivers/staging/gdm72xx/gdm_qos.c
+++ b/drivers/staging/gdm72xx/gdm_qos.c
@@ -190,15 +190,15 @@ static int chk_ipv4_rule(struct gdm_wimax_csr_s *csr, u8 *stream, u8 *port)
static int get_qos_index(struct nic *nic, u8 *iph, u8 *tcpudph)
{
- int IP_ver, i;
+ int ip_ver, i;
struct qos_cb_s *qcb = &nic->qos;
if (iph == NULL || tcpudph == NULL)
return -1;
- IP_ver = (iph[0]>>4)&0xf;
+ ip_ver = (iph[0]>>4)&0xf;
- if (IP_ver != 4)
+ if (ip_ver != 4)
return -1;
for (i = 0; i < QOS_MAX; i++) {
@@ -303,12 +303,12 @@ out:
return ret;
}
-static int get_csr(struct qos_cb_s *qcb, u32 SFID, int mode)
+static int get_csr(struct qos_cb_s *qcb, u32 sfid, int mode)
{
int i;
for (i = 0; i < qcb->qos_list_cnt; i++) {
- if (qcb->csr[i].SFID == SFID)
+ if (qcb->csr[i].sfid == sfid)
return i;
}
@@ -332,7 +332,7 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
{
struct nic *nic = nic_ptr;
int i, index, pos;
- u32 SFID;
+ u32 sfid;
u8 sub_cmd_evt;
struct qos_cb_s *qcb = &nic->qos;
struct qos_entry_s *entry, *n;
@@ -345,11 +345,11 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
if (sub_cmd_evt == QOS_REPORT) {
spin_lock_irqsave(&qcb->qos_lock, flags);
for (i = 0; i < qcb->qos_list_cnt; i++) {
- SFID = ((buf[(i*5)+6]<<24)&0xff000000);
- SFID += ((buf[(i*5)+7]<<16)&0xff0000);
- SFID += ((buf[(i*5)+8]<<8)&0xff00);
- SFID += (buf[(i*5)+9]);
- index = get_csr(qcb, SFID, 0);
+ sfid = ((buf[(i*5)+6]<<24)&0xff000000);
+ sfid += ((buf[(i*5)+7]<<16)&0xff0000);
+ sfid += ((buf[(i*5)+8]<<8)&0xff00);
+ sfid += (buf[(i*5)+9]);
+ index = get_csr(qcb, sfid, 0);
if (index == -1) {
spin_unlock_irqrestore(&qcb->qos_lock, flags);
netdev_err(nic->netdev, "QoS ERROR: No SF\n");
@@ -366,12 +366,12 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
/* sub_cmd_evt == QOS_ADD || sub_cmd_evt == QOS_CHANG_DEL */
pos = 6;
- SFID = ((buf[pos++]<<24)&0xff000000);
- SFID += ((buf[pos++]<<16)&0xff0000);
- SFID += ((buf[pos++]<<8)&0xff00);
- SFID += (buf[pos++]);
+ sfid = ((buf[pos++]<<24)&0xff000000);
+ sfid += ((buf[pos++]<<16)&0xff0000);
+ sfid += ((buf[pos++]<<8)&0xff00);
+ sfid += (buf[pos++]);
- index = get_csr(qcb, SFID, 1);
+ index = get_csr(qcb, sfid, 1);
if (index == -1) {
netdev_err(nic->netdev,
"QoS ERROR: csr Update Error / Wrong index (%d)\n",
@@ -381,10 +381,10 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
if (sub_cmd_evt == QOS_ADD) {
netdev_dbg(nic->netdev, "QOS_ADD SFID = 0x%x, index=%d\n",
- SFID, index);
+ sfid, index);
spin_lock_irqsave(&qcb->qos_lock, flags);
- qcb->csr[index].SFID = SFID;
+ qcb->csr[index].sfid = sfid;
qcb->csr[index].classifier_rule_en = ((buf[pos++]<<8)&0xff00);
qcb->csr[index].classifier_rule_en += buf[pos++];
if (qcb->csr[index].classifier_rule_en == 0)
@@ -422,7 +422,7 @@ void gdm_recv_qos_hci_packet(void *nic_ptr, u8 *buf, int size)
spin_unlock_irqrestore(&qcb->qos_lock, flags);
} else if (sub_cmd_evt == QOS_CHANGE_DEL) {
netdev_dbg(nic->netdev, "QOS_CHANGE_DEL SFID = 0x%x, index=%d\n",
- SFID, index);
+ sfid, index);
INIT_LIST_HEAD(&free_list);
diff --git a/drivers/staging/gdm72xx/gdm_qos.h b/drivers/staging/gdm72xx/gdm_qos.h
index ab03d33..8f742f3 100644
--- a/drivers/staging/gdm72xx/gdm_qos.h
+++ b/drivers/staging/gdm72xx/gdm_qos.h
@@ -33,7 +33,7 @@
struct gdm_wimax_csr_s {
bool enabled;
- u32 SFID;
+ u32 sfid;
u8 qos_buf_count;
u16 classifier_rule_en;
u8 ip2s_lo;
--
2.0.0.526.g5318336