From patchwork Tue Apr 25 16:24:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhang Shurong X-Patchwork-Id: 677999 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54F68C77B73 for ; Tue, 25 Apr 2023 16:24:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234206AbjDYQY2 (ORCPT ); Tue, 25 Apr 2023 12:24:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56212 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234620AbjDYQYZ (ORCPT ); Tue, 25 Apr 2023 12:24:25 -0400 Received: from out203-205-221-153.mail.qq.com (out203-205-221-153.mail.qq.com [203.205.221.153]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD98F10CC; Tue, 25 Apr 2023 09:24:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foxmail.com; s=s201512; t=1682439862; bh=sQKbtorZijfrBsSbG/R4wwtRRcylsXE+DoGloP7WmT8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bDvSD8cPyDzClEriXp9+T7nNfOHOXvwcR7i8ANZ21rO9Ti0sGyn1tLqEEEJ7khEfR tiEfI70V+Fj0T80ebpxcYoKtdh7Fk9OX7CHgC4DayhRKG2No2ZvsWYQinFkaciK9pQ U2BSUwh6PVFZXU16vAHsXRHII/7kPAgStzCNdyd8= Received: from localhost.localdomain ([116.132.239.134]) by newxmesmtplogicsvrsza12-0.qq.com (NewEsmtp) with SMTP id 60F0C276; Wed, 26 Apr 2023 00:24:15 +0800 X-QQ-mid: xmsmtpt1682439858tapcj3suu Message-ID: X-QQ-XMAILINFO: Ms5xyImz3IR/EQHELcyVQRQMm9Zy5ODFWYRoClZGAUWTl9fFI3AdYshw2WYnM4 0XkfHsK59txHhl4DDcsr1capeI5a7YRxfoMJZHhtIfUu/HjqB6JRIQ9jZ9l+hgiRuW0kbyzlAgtM Bz4XjZtmQ2BXPJN/Hg+ygOGIkV9KtHcRNFg9JU6k69OTbjjfi8ZEFrVvitVNq6DN0evf7TSVz0+x P2ZkhB7BUz1jq+LOF5tkY+FGaMQgiDa/ACEp8OFqH1xFE2uDlbNDFFNFPlnqhNr8SvNPH01/fTht qJJY//R6omnQ6uMHa2kKgZf9naoKHfXMbW54xfkS3RhwebBLkwhDlwc28na6X7l6DIW9jv2PYiYP fh9EsXL2OLXFze9gECk2+FXmsAXPKw+UMnEtBtXUBLFf9/iI12DzbQKFWRsaIg0BpTC5LmI3pm+c 9r1V1yJl3Mrslt0iiKvldy3Iq3uQBETmSyjJaFF8R91C+y0QA9pOAwvWQe23Wa/cTxKS8cqJvTUH j10TSvdaDyWsNBUUzSdhdW9LQjABSfQP5ZP/zBw6rSFw7RuAe2PSEdx2PgJszYjCVDbYoSPupvQG wDLY7g2WLsjXhdrYgaOQfnOTTgDXELiM8+18iDv7XYde0aETvP9g7TDBLhFCu9uWB9btLui5Mlot fc0Tuo8TYsDbcqZVa4kJPjtwgA99zPhBwDjxS00C3U0imfOx/Bvnr0fIVegu7C8rCki1qTOwzv5O 04FXY2/ImZnxijfuhNkyPusVBnnXk3VPT/+ZECR+WgmI3bqinogOBUbefYDzfNl7mzht36MfALnJ 6SpKu3EibdhMyiytMNwy9tDcrPs5yoxq/1K4jW1/2NP8PgyUYybjQXKcp4EAMg02CSdGfB+IEjls yujzTnWT0oSWBBGLiJwpldXphiwrCIvEZg/XL9fk9c2InknFdZryjY1v7VS1zEty2K9dDmoCq4ov 0Xa3ruWfigsWAKmtdUSZM3EkayPMM9SqEZXO4D/K+vb7QE9+ulyoUQfw4jiLbnXhAv58jMY4n0+B J+NzaFXH3Vu+0NhKHz From: Zhang Shurong To: tony0620emma@gmail.com Cc: kvalo@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Zhang Shurong Subject: [PATCH v2 1/2] wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user Date: Wed, 26 Apr 2023 00:24:11 +0800 X-OQ-MSGID: X-Mailer: git-send-email 2.40.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org If there is a failure during copy_from_user, rtw_debugfs_copy_from_user should return negative error code instead of a positive value count. Fix this bug by returning correct error code. Moreover, the check of buffer against null is removed since it will be handled by copy_from_user. Signed-off-by: Zhang Shurong --- drivers/net/wireless/realtek/rtw88/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c index fa3d73b333ba..3da477e1ebd3 100644 --- a/drivers/net/wireless/realtek/rtw88/debug.c +++ b/drivers/net/wireless/realtek/rtw88/debug.c @@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size, tmp_len = (count > size - 1 ? size - 1 : count); - if (!buffer || copy_from_user(tmp, buffer, tmp_len)) - return count; + if (copy_from_user(tmp, buffer, tmp_len)) + return -EFAULT; tmp[tmp_len] = '\0'; From patchwork Tue Apr 25 16:24:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhang Shurong X-Patchwork-Id: 677121 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCA13C77B61 for ; Tue, 25 Apr 2023 16:24:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234727AbjDYQYh (ORCPT ); Tue, 25 Apr 2023 12:24:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56330 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234714AbjDYQYb (ORCPT ); Tue, 25 Apr 2023 12:24:31 -0400 Received: from out203-205-221-242.mail.qq.com (out203-205-221-242.mail.qq.com [203.205.221.242]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6545D161A4; Tue, 25 Apr 2023 09:24:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=foxmail.com; s=s201512; t=1682439864; bh=IDTmH6R2OwB+nQcAtD+Ty/w+VtwcXIHQkO3n55itJrI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NX+HKXCq2Sbsb3WL9o1Fo8A+NRjhUAJXVD9M77qucsTwjr2BuhBVbOWG40ANI0wSx PbVRoVEVRe6ZYOy7beJSZKH76rTuA7RryW3qqbcg4a9wf161Tj1laNRaD7gVm+czxc FKDp6SAB/GMCPBpkBzaghXh9KMr7o+QrzefvS31o= Received: from localhost.localdomain ([116.132.239.134]) by newxmesmtplogicsvrsza12-0.qq.com (NewEsmtp) with SMTP id 60F0C276; Wed, 26 Apr 2023 00:24:15 +0800 X-QQ-mid: xmsmtpt1682439861tim77xyyv Message-ID: X-QQ-XMAILINFO: NkHKfw09D6j8SaLeVQ/sV0Dvr/JRRZGPIwo8MAdjXGZaZxNEgBUwD6ayKk/efP Y0vH3jVAAoOfZsBm1pYBEQcmc2m75348H6pQCpaPsi0hNr5eOabZ1VJzaF84gCY7BZ5V9F9bog82 0IZf8SpcW+n1gFBGz9UDb+335g5hlJszsCNmidzSYOSAuRguoP9PBe8nqtmkmlS9L+tjy43itWDL IrlZ/0adhbueTurgtsCRricF7vKUTQjkvW77N5Dmn6l8RHkyPWV+gdlRsTjFBbRtNeCqFq/SSehX ptrvhB/5eHjMXyxIWDXlL7L/KncUPc2myn6OKJXumJrT8dJsziU2TDpXoM/GPZ2SQbIOHcJIgUMx 8GBBhemdux6KCYQHpGHHA+UA8GAcmnfp/Pp/jWSGm9STFPVi45+wxphb8oYJlGKQzcKIvlZqHqmI 96F2Kfd0e6WU9TBaBLe/82857QSj55Q4JSRk0syX3cTafhQAnACLJaKw9HZowvKyn07nl89jS8ia LCCmCF7VmiJmXiwyfJqrpNqTvxJ3TIo9IAJBzKL6yYkxf6obWUkg/8UAjUG0nkTI6pFCH0f7WlTF LwJbMUrWMpRL+oggkhDvDlHdZM4g65+/lAKmrxZVnCktc+g/6UntFZKaua6mxgSP/KZp13EZi1bD 5DG4VtptY8aj/W5TXHqOR92ok2CfuBQUI0Yd8VJuzTawuLpiLG7RZctGL3U+JZ65oKk156u4DQut rYhdm2J/agd3yuXXbQmcmjeyCGlQJwa/W1tpSXVzZg6HMcHppZNxO2QD93/+gYrzE1k7eao0jMR3 CYs2sQz5LJ6+sKlSlGemheg64LLUx/c5J8945PWTzIT0yPl7VEzjprObffCm12+ztGmIFLByoXj1 5a3SQtiBesDBwteqjlhLDzIZod/fSJyMPR90D5L07ov/sdn9Zu4utwdTBlFCtzm6TuP2BHpUP8Cb 4NJRCl8aZH8RjvW1nDBGKy1uWOmKXLrtCO8cfaKnPQjTGkuh9kwMjvcaWekHCOaXYv188Kc7L29T 4dW/PIBA== From: Zhang Shurong To: tony0620emma@gmail.com Cc: kvalo@kernel.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Zhang Shurong Subject: [PATCH v2 2/2] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_* Date: Wed, 26 Apr 2023 00:24:12 +0800 X-OQ-MSGID: X-Mailer: git-send-email 2.40.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org If there is a failure during copy_from_user or user-provided data buffer is invalid, rtw_debugfs_set_* should return negative error code instead of a positive value count. Fix this bug by returning correct error code. Signed-off-by: Zhang Shurong --- drivers/net/wireless/realtek/rtw88/debug.c | 55 ++++++++++++++++------ 1 file changed, 41 insertions(+), 14 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c index 3da477e1ebd3..786669a092f1 100644 --- a/drivers/net/wireless/realtek/rtw88/debug.c +++ b/drivers/net/wireless/realtek/rtw88/debug.c @@ -201,13 +201,16 @@ static ssize_t rtw_debugfs_set_read_reg(struct file *filp, char tmp[32 + 1]; u32 addr, len; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2); + if (ret < 0) + return ret; num = sscanf(tmp, "%x %x", &addr, &len); if (num != 2) - return count; + return -EINVAL; if (len != 1 && len != 2 && len != 4) { rtw_warn(rtwdev, "read reg setting wrong len\n"); @@ -288,8 +291,11 @@ static ssize_t rtw_debugfs_set_rsvd_page(struct file *filp, char tmp[32 + 1]; u32 offset, page_num; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2); + if (ret < 0) + return ret; num = sscanf(tmp, "%d %d", &offset, &page_num); @@ -314,8 +320,11 @@ static ssize_t rtw_debugfs_set_single_input(struct file *filp, char tmp[32 + 1]; u32 input; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + if (ret < 0) + return ret; num = kstrtoint(tmp, 0, &input); @@ -338,14 +347,17 @@ static ssize_t rtw_debugfs_set_write_reg(struct file *filp, char tmp[32 + 1]; u32 addr, val, len; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + if (ret < 0) + return ret; /* write BB/MAC register */ num = sscanf(tmp, "%x %x %x", &addr, &val, &len); if (num != 3) - return count; + return -EINVAL; switch (len) { case 1: @@ -381,8 +393,11 @@ static ssize_t rtw_debugfs_set_h2c(struct file *filp, char tmp[32 + 1]; u8 param[8]; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + if (ret < 0) + return ret; num = sscanf(tmp, "%hhx,%hhx,%hhx,%hhx,%hhx,%hhx,%hhx,%hhx", ¶m[0], ¶m[1], ¶m[2], ¶m[3], @@ -408,14 +423,17 @@ static ssize_t rtw_debugfs_set_rf_write(struct file *filp, char tmp[32 + 1]; u32 path, addr, mask, val; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 4); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 4); + if (ret < 0) + return ret; num = sscanf(tmp, "%x %x %x %x", &path, &addr, &mask, &val); if (num != 4) { rtw_warn(rtwdev, "invalid args, [path] [addr] [mask] [val]\n"); - return count; + return -EINVAL; } mutex_lock(&rtwdev->mutex); @@ -438,14 +456,17 @@ static ssize_t rtw_debugfs_set_rf_read(struct file *filp, char tmp[32 + 1]; u32 path, addr, mask; int num; + int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3); + if (ret < 0) + return ret; num = sscanf(tmp, "%x %x %x", &path, &addr, &mask); if (num != 3) { rtw_warn(rtwdev, "invalid args, [path] [addr] [mask] [val]\n"); - return count; + return -EINVAL; } debugfs_priv->rf_path = path; @@ -467,7 +488,9 @@ static ssize_t rtw_debugfs_set_fix_rate(struct file *filp, char tmp[32 + 1]; int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + if (ret < 0) + return ret; ret = kstrtou8(tmp, 0, &fix_rate); if (ret) { @@ -860,7 +883,9 @@ static ssize_t rtw_debugfs_set_coex_enable(struct file *filp, bool enable; int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + if (ret < 0) + return ret; ret = kstrtobool(tmp, &enable); if (ret) { @@ -930,7 +955,9 @@ static ssize_t rtw_debugfs_set_fw_crash(struct file *filp, bool input; int ret; - rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1); + if (ret < 0) + return ret; ret = kstrtobool(tmp, &input); if (ret)