Increase by one the size of wid_list array as index variable can reach a
value of 5. If this happens, an out-of-bounds access is performed.
Also, use a #define instead of a hard-coded literal for the new array
size.
Addresses-Coverity-ID: 1451981 ("Out-of-bounds access")
Fixes: f5a3cb90b8 ("staging: wilc1000: add passive scan support")
Acked-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200504150911.4470-1-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
As suggested by Joe Perches, this patch removes the 'exit' label
from the ql_set_mac_addr_reg function and replaces the goto
statements with break statements.
Signed-off-by: Rylan Dmello <mail@rylan.coffee>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/a6f485e43eb55e8fdc64a7a346cb0419b55c3cb6.1588209862.git.mail@rylan.coffee
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Based on Joe Perches' feedback, fix the indentation throughout
ql_set_mac_addr_reg. This helps fix several "line over 80 characters"
warnings along with the original "multiple line dereference" warning.
Fix checkpatch.pl warnings:
WARNING: Avoid multiple line dereference - prefer 'qdev->func'
WARNING: line over 80 characters
Signed-off-by: Rylan Dmello <mail@rylan.coffee>
Link: https://lore.kernel.org/r/299f2cb3b7d4efa30b44d4d1defbcd5f54bd7eaf.1588209862.git.mail@rylan.coffee
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch removes the unlikely macros in the error patch of argument
checking, as it has no measurable performance adavantage.
Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/1588672829-28883-4-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The interface pointer passed to a core API function cannot be NULL. This
patch removes unnessecary the sanity check of the pointer.
Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/1588672829-28883-2-git-send-email-christian.gromm@microchip.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The inflection parameter, i.e. the pitch range, allows to change the
expressiveness of the synthesized voice. This is supported by the DEC
talk synths, and software synthesizers such as espeak/espeak-ng.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Link: https://lore.kernel.org/r/20200425193226.nv3zfd4k3xavi353@function
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/core/rtw_mlme.c:2920:6: warning: variable
‘pframe’ set but not used [-Wunused-but-set-variable]
u8 *pframe;
^~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-8-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/core/rtw_mlme.c:1100:24: warning: variable
‘pwrpriv’ set but not used [-Wunused-but-set-variable]
struct pwrctrl_priv *pwrpriv;
^~~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-7-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:1173:18: warning: variable
‘listen_interval’ set but not used [-Wunused-but-set-variable]
u16 capab_info, listen_interval;
^~~~~~~~~~~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-6-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:1087:33: warning: variable
‘algthm’ set but not used [-Wunused-but-set-variable]
unsigned int seq, len, status, algthm, offset;
^~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-5-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/core/rtw_sta_mgt.c:556:19: warning: variable
‘ptxservq’ set but not used [-Wunused-but-set-variable]
struct tx_servq *ptxservq;
^~~~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-4-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
And also remove the NULL check before kfree() because kfree() can handle
NULL pointers correctly.
Fix the following gcc warning:
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:157:6: warning:
variable ‘size’ set but not used [-Wunused-but-set-variable]
u32 size = 0;
^~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-3-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fix the following gcc warning:
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:2564:22: warning:
variable ‘uintRet’ set but not used [-Wunused-but-set-variable]
unsigned int uintRet = 0;
^~~~~~~
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Jason Yan <yanaijie@huawei.com>
Link: https://lore.kernel.org/r/20200427032342.27211-2-yanaijie@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace three while loops with three calls to the vnt_control_out_blocks
function. This way avoid repeat a functionality that already exists.
Also remove the variables that now are not used.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425151747.8199-4-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Replace the "goto" statements with a direct "return ret" as the jump
label only returns the ret variable.
Also, remove the unnecessary variable initialization because the ret
variable is set a few lines later.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425151747.8199-3-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the local variable "array" and all the memcpy function calls
because this copy operation from different arrays to this variable is
unnecessary.
The vnt_control_out function already does a kmemdup copy of its const
char *buffer argument and this was made unnecessary by:
commit 12ecd24ef9
("staging: vt6656: use off stack for out buffer USB transfers.")
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date: Sat Apr 22 11:14:57 2017 +0100
staging: vt6656: use off stack for out buffer USB transfers.
Since 4.9 mandated USB buffers be heap allocated this causes the driver
to fail.
Since there is a wide range of buffer sizes use kmemdup to create
allocated buffer.
So, the same result can be achieved using the arrays directly.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425151747.8199-2-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove debug print statements referring to non-existent fields
'lbq_clean_idx' and 'lbq_free_cnt' in the 'rx_ring' struct, which causes
a compilation failure when QL_DEV_DUMP is set.
These fields were initially removed as a part of commit aec626d209
("staging: qlge: Update buffer queue prod index despite oom") in 2019.
Their replacement fields ('next_to_use' and 'next_to_clean') are already
being printed, so this patch does not add new debug statements for them.
Signed-off-by: Rylan Dmello <mail@rylan.coffee>
Link: https://lore.kernel.org/r/aa7e0197f4e34cec0855124e45696e33dd9527e5.1587959245.git.mail@rylan.coffee
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove statement that tries to print the non-existent 'vlgrp' field
in the 'ql_adapter' struct, which causes a compilation failure when
QL_DEV_DUMP is set.
vlgrp seems to have been removed from ql_adapter as a part of
commit 18c49b9177 ("qlge: do vlan cleanup") in 2011.
vlgrp might be replaced by the 'active_vlans' array introduced in the
aforementioned commit. But I'm not sure if printing all 64 values of
that array would help with debugging this driver, so I'm leaving it
out of the debug code in this patch.
Signed-off-by: Rylan Dmello <mail@rylan.coffee>
Link: https://lore.kernel.org/r/51bae37a54d414491779e4a3329508cc864ab900.1587959245.git.mail@rylan.coffee
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
duration_id is not used by driver anymore so remove the returns
and set all functions in patch to void.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Link: https://lore.kernel.org/r/04a9c19f-c374-c175-6e46-d1bfbab2f42e@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Use a formula to calculate the return value of the vnt_rf_addpower
function instead of the "if" statement with literal values for every
case.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425141514.5528-1-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Remove the functions' documentation as the names of the functions are
clear enought. Also, the actual documentation it's not correct in all
cases.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425134257.4502-3-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Check the return value of vnt_control_out_* function calls. When
necessary modify the function prototype to be able to return the new
checked error code.
It's safe to modify all the function prototypes without fix the call
because the only change is the return value from void to int. If before
the call didn't check the return value, now neither.
Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
Link: https://lore.kernel.org/r/20200425134257.4502-2-oscar.carter@gmx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
skb clones use same data buffer,
so tail of one skb is corrupted by beginning of next skb.
Signed-off-by: Ivan Safonov <insafonov@gmail.com>
Link: https://lore.kernel.org/r/20200423191404.12028-1-insafonov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The device raises error indications when it thinks there is a bug in the
driver and it can't recover it (while it raises exception when a bug is
detected in the device).
The current list of of errors was a bit dated.
This patch cleans up the list of errors and the associated message. It
is also the right time to clean up the way the error indications are
handled. Replace the switch..case with a clean loop over an array.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-18-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Until now, the exception received from the chip was only displayed if
driver was compiled with DEBUG enabled. It was not very convenient to
help users. We prefer to show the exception unconditionally.
In add, this patch provides the semantic of the first bytes of the
struct.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-17-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The names of the hardware interface messages are not displayed correctly
in tracepoints. Thus, REQ_JOIN is displayed JOIN_REQ. Fix that in order
to get the names as defined in headers of HIF API.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-16-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Some messages are missing from the list of symbolic messages defined in
traces.h. Add them.
Also sort the list in order to simplify next changes.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-15-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The struct hif_mib_extended_count_table contains some debug information
accessible from the debugfs. The struct contains not yet used fields at
the end. In order to support future firmware versions, this patch also
show these not yet named fields.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-14-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The device keep up to date three series of stats. One for each
virtual interface and one for the whole device.
Until to now, the stats for the whole device were unavailable. Moreover,
it is interesting to retrieve counters for all interfaces even if they
are not awake.
Change the counters available in debugfs in order to retrieve stats
from all interfaces.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-13-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
In some circumstances, Tx traffic is sent without associated station but
the station exists when the Tx status is received. Beside that, the
driver keep a counter associated to each station. So, in this case, the
counter is not incremented, but is decremented. In this case a warning
"inconsistent notification" appears:
------------[ cut here ]------------
WARNING: CPU: 3 PID: 82 at /home/jerome/wfx/data_tx.c:469 wfx_skb_dtor+0x1a4/0x1d4 [wfx]
inconsistent notification
Modules linked in: [...]
CPU: 3 PID: 82 Comm: kworker/3:1H Tainted: G C O 4.19.57-v7l+ #1244
Hardware name: BCM2835
Workqueue: events_highpri bh_work [wfx]
[<c0212c8c>] (unwind_backtrace) from [<c020d49c>] (show_stack+0x20/0x24)
[<c020d49c>] (show_stack) from [<c0976220>] (dump_stack+0xd4/0x118)
[<c0976220>] (dump_stack) from [<c0222270>] (__warn+0x104/0x11c)
[<c0222270>] (__warn) from [<c02222e0>] (warn_slowpath_fmt+0x58/0x74)
[<c02222e0>] (warn_slowpath_fmt) from [<bf497b48>] (wfx_skb_dtor+0x1a4/0x1d4 [wfx])
[<bf497b48>] (wfx_skb_dtor [wfx]) from [<bf4988b4>] (wfx_tx_confirm_cb+0x198/0x2f0 [wfx])
[<bf4988b4>] (wfx_tx_confirm_cb [wfx]) from [<bf49d054>] (hif_tx_confirm+0x50/0x70 [wfx])
[<bf49d054>] (hif_tx_confirm [wfx]) from [<bf49d42c>] (wfx_handle_rx+0x128/0x22c [wfx])
[<bf49d42c>] (wfx_handle_rx [wfx]) from [<bf4953cc>] (bh_work+0x3cc/0x964 [wfx])
[<bf4953cc>] (bh_work [wfx]) from [<c023dab8>] (process_one_work+0x170/0x458)
[<c023dab8>] (process_one_work) from [<c023ddfc>] (worker_thread+0x5c/0x5a4)
[<c023ddfc>] (worker_thread) from [<c02440e8>] (kthread+0x138/0x168)
[<c02440e8>] (kthread) from [<c02010ac>] (ret_from_fork+0x14/0x28)
Exception stack(0xee199fb0 to 0xee199ff8)
9fa0: 00000000 00000000 00000000 00000000
9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
---[ end trace 64b9e754e12ef7de ]---
This patch fix this race between the station creation and the Tx data.
Fixes: 7d2d2bfdeb ("staging: wfx: relocate "buffered" information to sta_priv")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-11-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
It has been reported that trying to send small packets of data could
produce a "inconsistent notification" warning.
It seems that in some circumstances, the number of frame queued in the
driver could greatly increase and exceed UCHAR_MAX. So the field
"buffered" from struct sta_priv can overflow.
Just increase the size of "bueffered" to fix the problem.
Fixes: 7d2d2bfdeb ("staging: wfx: relocate "buffered" information to sta_priv")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-10-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The highest Rx value declared in ieee80211_supported_band had two
problems:
1. The value should be little endian
2. ShortGI was not taken into account. So value should be 72 instead
of 65.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-9-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Device is able to measure its temperature and raise warning when this
one is too high. If the the temperature is even higher, the chipis also
able to send an error just before to stop responding.
Until now, the error message was "asynchronous error: unknown (6)".
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-8-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Device is able to detect a high temperature. In this case, the traffic
is not allowed to be sent until the temperature decrease.
This patch detects the warnings raised by the device and stop the
traffic accordingly. It also add a delayed task as safeguard in case the
chip would never send the indication that the temperature decrease.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-7-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
wfx_suspend_resume_mc() is called when the device is about to sent a
DTIM. This is the right moment to enqueue Content After DTIM Beacon
(CAB).
However, wfx_suspend_resume_mc() is also called when the DTIM period
ends. Until now, this event did also trig CAB.
Note this issue did not have too much impact since when a CAB is sent
outside of DTIM window, an error is reported by the firmware and
mac80211 retries to send the data.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-6-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When multiple virtual interfaces (on different channels) are in use, the
device ask to activate Power Save on station interfaces. The device
developers recommends to use legacy PS-Poll in this case since it is the
mode that disturb the less the other interface. However, some AP start
to not answer anymore to PS-Poll. The device is able to detect this case
and return a special warning in this case.
So, this commit catch the warning and force usage of FastPS in this
case.
In order to confuse the less possible the other interface a small FastPS
period is used (30ms).
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-5-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When the driver receive an error indication, it means the chip won't
answer to any command anymore. Therefore, mark the chip frozen when it
happens (as when the driver receive an exception indication).
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-4-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The field chip_frozen is declared as an integer, but it is only used as
a boolean. So, convert it into a boolean.
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20200427134031.323403-3-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Oscar Carter