2017-07-11 14:31:04

by Amitkumar Karwar

Subject: [PATCH 1/3] rsi: use macro for allocating USB buffer

From: Amitkumar Karwar <[email protected]>

4 bytes is fixed size for reading or writing USB register. We
will use a macro instead of hardcoding this.

Fixes: b97e9b94ad75c ("rsi: Add new host interface operations")
Signed-off-by: Amitkumar Karwar <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_usb.c | 4 ++--
drivers/net/wireless/rsi/rsi_usb.h | 1 +
2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 3febf24..99a520a 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -162,7 +162,7 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
u8 *buf;
int status = -ENOMEM;

- buf = kmalloc(0x04, GFP_KERNEL);
+ buf = kmalloc(RSI_USB_CTRL_BUF_SIZE, GFP_KERNEL);
if (!buf)
return status;

@@ -204,7 +204,7 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
u8 *usb_reg_buf;
int status = -ENOMEM;

- usb_reg_buf = kmalloc(0x04, GFP_KERNEL);
+ usb_reg_buf = kmalloc(RSI_USB_CTRL_BUF_SIZE, GFP_KERNEL);
if (!usb_reg_buf)
return status;

diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h
index 3babf81..891daea 100644
--- a/drivers/net/wireless/rsi/rsi_usb.h
+++ b/drivers/net/wireless/rsi/rsi_usb.h
@@ -37,6 +37,7 @@
#define BT_EP 2

#define RSI_USB_BUF_SIZE 4096
+#define RSI_USB_CTRL_BUF_SIZE 0x04

struct rsi_91x_usbdev {
struct rsi_thread rx_thread;
--
2.7.4

2017-07-11 14:31:08

by Amitkumar Karwar

Subject: [PATCH 2/3] rsi: check length before USB read/write register

From: Amitkumar Karwar <[email protected]>

These checks are required. Otherwise we may end up getting
memory corruption if invalid length is passed.

Fixes: b97e9b94ad75c ("rsi: Add new host interface operations")
Signed-off-by: Amitkumar Karwar <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_usb.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 99a520a..3d33ce9 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -166,6 +166,9 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
if (!buf)
return status;

+ if (len > RSI_USB_CTRL_BUF_SIZE)
+ return -EINVAL;
+
status = usb_control_msg(usbdev,
usb_rcvctrlpipe(usbdev, 0),
USB_VENDOR_REGISTER_READ,
@@ -208,6 +211,9 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
if (!usb_reg_buf)
return status;

+ if (len > RSI_USB_CTRL_BUF_SIZE)
+ return -EINVAL;
+
usb_reg_buf[0] = (value & 0x00ff);
usb_reg_buf[1] = (value & 0xff00) >> 8;
usb_reg_buf[2] = 0x0;
--
2.7.4

2017-07-11 14:38:09

by Amitkumar Karwar

Subject: [PATCH 3/3] rsi: fix static checker warning

From: Amitkumar Karwar <[email protected]>

u32 pointer is changed to u16 and filled the value. Problem is
solved by using local temporary variable. Below static checker
warning was reported.

drivers/net/wireless/rsi/rsi_91x_usb.c:400 rsi_usb_master_reg_read()
warn: passing casted pointer 'value' to 'rsi_usb_reg_read()'
32 vs 16.

Fixes: b97e9b94ad75c ("rsi: Add new host interface operations")
Signed-off-by: Amitkumar Karwar <[email protected]>
---
drivers/net/wireless/rsi/rsi_91x_usb.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 3d33ce9..9097f7e 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -404,8 +404,15 @@ static int rsi_usb_master_reg_read(struct rsi_hw *adapter, u32 reg,
{
struct usb_device *usbdev =
((struct rsi_91x_usbdev *)adapter->rsi_dev)->usbdev;
+ u16 temp;
+ int ret;

- return rsi_usb_reg_read(usbdev, reg, (u16 *)value, len);
+ ret = rsi_usb_reg_read(usbdev, reg, &temp, len);
+ if (ret < 0)
+ return ret;
+ *value = temp;
+
+ return 0;
}

static int rsi_usb_master_reg_write(struct rsi_hw *adapter,
--
2.7.4

2017-07-28 14:28:20

by Kalle Valo

Subject: Re: [1/3] rsi: use macro for allocating USB buffer

Amitkumar Karwar <[email protected]> wrote:

> From: Amitkumar Karwar <[email protected]>
>
> 4 bytes is fixed size for reading or writing USB register. We
> will use a macro instead of hardcoding this.
>
> Fixes: b97e9b94ad75c ("rsi: Add new host interface operations")
> Signed-off-by: Amitkumar Karwar <[email protected]>

3 patches applied to wireless-drivers-next.git, thanks.

523b724a769b rsi: use macro for allocating USB buffer
59f73e2ae185 rsi: check length before USB read/write register
e6249e15fea2 rsi: fix static checker warning

--
https://patchwork.kernel.org/patch/9834829/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches