Commit 3d6b77a8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 

Pull staging driver fixes from Greg KH:
 "Here are three small staging driver fixes for 6.5-rc4 that resolve
  some reported problems. These fixes are:

   - fix for an old bug in the r8712 driver

   - fbtft driver fix for a spi device

   - potential overflow fix in the ks7010 driver

  All of these have been in linux-next with no reported problems"

* tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
  staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER
  staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
parents cf270e7b 5f1c7031

drivers/staging/fbtft/fb_ili9341.c

+1 −1
Original line number Diff line number Diff line
@@ -145,7 +145,7 @@ static struct fbtft_display display = { 
	},

};



FBTFT_REGISTER_DRIVER(DRVNAME, "ilitek,ili9341", &display);

FBTFT_REGISTER_SPI_DRIVER(DRVNAME, "ilitek", "ili9341", &display);



MODULE_ALIAS("spi:" DRVNAME);

MODULE_ALIAS("platform:" DRVNAME);

drivers/staging/ks7010/ks_wlan_net.c

+4 −2
Original line number Diff line number Diff line
@@ -1583,8 +1583,10 @@ static int ks_wlan_set_encode_ext(struct net_device *dev, 
			commit |= SME_WEP_FLAG;

		}

		if (enc->key_len) {

			memcpy(&key->key_val[0], &enc->key[0], enc->key_len);

			key->key_len = enc->key_len;

			int key_len = clamp_val(enc->key_len, 0, IW_ENCODING_TOKEN_MAX);



			memcpy(&key->key_val[0], &enc->key[0], key_len);

			key->key_len = key_len;

			commit |= (SME_WEP_VAL1 << index);

		}

		break;

drivers/staging/rtl8712/rtl871x_xmit.c

+34 −9
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 
#include "osdep_intf.h"

#include "usb_ops.h"



#include <linux/usb.h>

#include <linux/ieee80211.h>



static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8};
@@ -55,6 +56,7 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, 
	sint i;

	struct xmit_buf *pxmitbuf;

	struct xmit_frame *pxframe;

	int j;



	memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));

	spin_lock_init(&pxmitpriv->lock);
@@ -117,11 +119,8 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, 
	_init_queue(&pxmitpriv->pending_xmitbuf_queue);

	pxmitpriv->pallocated_xmitbuf =

		kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC);

	if (!pxmitpriv->pallocated_xmitbuf) {

		kfree(pxmitpriv->pallocated_frame_buf);

		pxmitpriv->pallocated_frame_buf = NULL;

		return -ENOMEM;

	}

	if (!pxmitpriv->pallocated_xmitbuf)

		goto clean_up_frame_buf;

	pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -

			      ((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3);

	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
@@ -129,13 +128,17 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, 
		INIT_LIST_HEAD(&pxmitbuf->list);

		pxmitbuf->pallocated_buf =

			kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC);

		if (!pxmitbuf->pallocated_buf)

			return -ENOMEM;

		if (!pxmitbuf->pallocated_buf) {

			j = 0;

			goto clean_up_alloc_buf;

		}

		pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -

				 ((addr_t) (pxmitbuf->pallocated_buf) &

				 (XMITBUF_ALIGN_SZ - 1));

		if (r8712_xmit_resource_alloc(padapter, pxmitbuf))

			return -ENOMEM;

		if (r8712_xmit_resource_alloc(padapter, pxmitbuf)) {

			j = 1;

			goto clean_up_alloc_buf;

		}

		list_add_tail(&pxmitbuf->list,

				 &(pxmitpriv->free_xmitbuf_queue.queue));

		pxmitbuf++;
@@ -146,6 +149,28 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv, 
	init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);

	tasklet_setup(&pxmitpriv->xmit_tasklet, r8712_xmit_bh);

	return 0;



clean_up_alloc_buf:

	if (j) {

		/* failure happened in r8712_xmit_resource_alloc()

		 * delete extra pxmitbuf->pallocated_buf

		 */

		kfree(pxmitbuf->pallocated_buf);

	}

	for (j = 0; j < i; j++) {

		int k;



		pxmitbuf--;			/* reset pointer */

		kfree(pxmitbuf->pallocated_buf);

		for (k = 0; k < 8; k++)		/* delete xmit urb's */

			usb_free_urb(pxmitbuf->pxmit_urb[k]);

	}

	kfree(pxmitpriv->pallocated_xmitbuf);

	pxmitpriv->pallocated_xmitbuf = NULL;

clean_up_frame_buf:

	kfree(pxmitpriv->pallocated_frame_buf);

	pxmitpriv->pallocated_frame_buf = NULL;

	return -ENOMEM;

}



void _free_xmit_priv(struct xmit_priv *pxmitpriv)

drivers/staging/rtl8712/xmit_linux.c

+6 −0
Original line number Diff line number Diff line
@@ -112,6 +112,12 @@ int r8712_xmit_resource_alloc(struct _adapter *padapter, 
	for (i = 0; i < 8; i++) {

		pxmitbuf->pxmit_urb[i] = usb_alloc_urb(0, GFP_KERNEL);

		if (!pxmitbuf->pxmit_urb[i]) {

			int k;



			for (k = i - 1; k >= 0; k--) {

				/* handle allocation errors part way through loop */

				usb_free_urb(pxmitbuf->pxmit_urb[k]);

			}

			netdev_err(padapter->pnetdev, "pxmitbuf->pxmit_urb[i] == NULL\n");

			return -ENOMEM;

		}