Commit 0469fc6a authored by Colin Ian King's avatar Colin Ian King Committed by Greg Kroah-Hartman
Browse files

staging: wfx: check for memory allocation failures from wfx_alloc_hif 



Currently calls to wfx_alloc_hif are not checking for a null return
when a memory allocation fails and this leads to null pointer
dereferencing issues.  Fix this by adding null pointer checks and
returning passing down -ENOMEM errors where necessary. The error
checking in the current driver is a bit sparse, so this may need
some extra attention later if required.

Fixes: f95a29d4 ("staging: wfx: add HIF commands helpers")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20191221001543.15255-1-colin.king@canonical.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5f33771f

drivers/staging/wfx/hif_tx.c

+6 −0
Original line number Diff line number Diff line
@@ -366,6 +366,9 @@ int hif_set_edca_queue_params(struct wfx_vif *wvif, u16 queue, 
	struct hif_req_edca_queue_params *body = wfx_alloc_hif(sizeof(*body),

							       &hif);



	if (!body)

		return -ENOMEM;



	WARN_ON(arg->aifs > 255);

	body->aifsn = arg->aifs;

	body->cw_min = cpu_to_le16(arg->cw_min);
@@ -390,6 +393,9 @@ int hif_set_pm(struct wfx_vif *wvif, bool ps, int dynamic_ps_timeout) 
	struct hif_msg *hif;

	struct hif_req_set_pm_mode *body = wfx_alloc_hif(sizeof(*body), &hif);



	if (!body)

		return -ENOMEM;



	if (ps) {

		body->pm_mode.enter_psm = 1;

		// Firmware does not support more than 128ms

drivers/staging/wfx/sta.c

+7 −6
Original line number Diff line number Diff line
@@ -316,6 +316,7 @@ int wfx_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
{

	struct wfx_dev *wdev = hw->priv;

	struct wfx_vif *wvif = (struct wfx_vif *) vif->drv_priv;

	int ret = 0;



	WARN_ON(queue >= hw->queues);
@@ -326,10 +327,10 @@ int wfx_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
	if (wvif->vif->type == NL80211_IFTYPE_STATION) {

		hif_set_uapsd_info(wvif, wvif->uapsd_mask);

		if (wvif->setbssparams_done && wvif->state == WFX_STATE_STA)

			wfx_update_pm(wvif);

			ret = wfx_update_pm(wvif);

	}

	mutex_unlock(&wdev->conf_mutex);

	return 0;

	return ret;

}



int wfx_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
@@ -1322,7 +1323,7 @@ int wfx_config(struct ieee80211_hw *hw, u32 changed) 
	if (changed & IEEE80211_CONF_CHANGE_PS) {

		wvif = NULL;

		while ((wvif = wvif_iterate(wdev, wvif)) != NULL)

			wfx_update_pm(wvif);

			ret = wfx_update_pm(wvif);

		wvif = wdev_to_wvif(wdev, 0);

	}
@@ -1333,7 +1334,7 @@ int wfx_config(struct ieee80211_hw *hw, u32 changed) 


int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)

{

	int i;

	int i, ret = 0;

	struct wfx_dev *wdev = hw->priv;

	struct wfx_vif *wvif = (struct wfx_vif *) vif->drv_priv;
@@ -1417,9 +1418,9 @@ int wfx_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) 
		else

			hif_set_block_ack_policy(wvif, 0x00, 0x00);

		// Combo force powersave mode. We can re-enable it now

		wfx_update_pm(wvif);

		ret = wfx_update_pm(wvif);

	}

	return 0;

	return ret;

}



void wfx_remove_interface(struct ieee80211_hw *hw,

CRA Git | Maintained and supported by SUSTech CRA and CCSE