linux.git/drivers/staging/rtl8192e, branch v5.4.131

staging: rtl8192e: Change state information from u16 to u8

2021-04-07T12:47:44+00:00

commit e78836ae76d20f38eed8c8c67f21db97529949da upstream.

The "u16 CcxRmState[2];" array field in struct "rtllib_network" has 4
bytes in total while the operations performed on this array through-out
the code base are only 2 bytes.

The "CcxRmState" field is fed only 2 bytes of data using memcpy():

(In rtllib_rx.c:1972)
	memcpy(network->CcxRmState, &info_element->data[4], 2)

With "info_element->data[]" being a u8 array, if 2 bytes are written
into "CcxRmState" (whose one element is u16 size), then the 2 u8
elements from "data[]" gets squashed and written into the first element
("CcxRmState[0]") while the second element ("CcxRmState[1]") is never
fed with any data.

Same in file rtllib_rx.c:2522:
	 memcpy(dst->CcxRmState, src->CcxRmState, 2);

The above line duplicates "src" data to "dst" but only writes 2 bytes
(and not 4, which is the actual size). Again, only 1st element gets the
value while the 2nd element remains uninitialized.

This later makes operations done with CcxRmState unpredictable in the
following lines as the 1st element is having a squashed number while the
2nd element is having an uninitialized random number.

rtllib_rx.c:1973:    if (network->CcxRmState[0] != 0)
rtllib_rx.c:1977:    network->MBssidMask = network->CcxRmState[1] & 0x07;

network->MBssidMask is also of type u8 and not u16.

Fix this by changing the type of "CcxRmState" from u16 to u8 so that the
data written into this array and read from it make sense and are not
random values.

NOTE: The wrong initialization of "CcxRmState" can be seen in the
following commit:

commit ecdfa44610fa ("Staging: add Realtek 8192 PCI wireless driver")

The above commit created a file `rtl8192e/ieee80211.h` which used to
have the faulty line. The file has been deleted (or possibly renamed)
with the contents copied in to a new file `rtl8192e/rtllib.h` along with
additional code in the commit 94a799425eee (tagged in Fixes).

Fixes: 94a799425eee ("From: wlanfae  [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
Cc: stable@vger.kernel.org
Signed-off-by: Atul Gopinathan 
Link: https://lore.kernel.org/r/20210323113413.29179-2-atulgopinathan@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: Fix incorrect source in memcpy()

2021-04-07T12:47:44+00:00

commit 72ad25fbbb78930f892b191637359ab5b94b3190 upstream.

The variable "info_element" is of the following type:

	struct rtllib_info_element *info_element

defined in drivers/staging/rtl8192e/rtllib.h:

	struct rtllib_info_element {
		u8 id;
		u8 len;
		u8 data[];
	} __packed;

The "len" field defines the size of the "data[]" array. The code is
supposed to check if "info_element->len" is greater than 4 and later
equal to 6. If this is satisfied then, the last two bytes (the 4th and
5th element of u8 "data[]" array) are copied into "network->CcxRmState".

Right now the code uses "memcpy()" with the source as "&info_element[4]"
which would copy in wrong and unintended information. The struct
"rtllib_info_element" has a size of 2 bytes for "id" and "len",
therefore indexing will be done in interval of 2 bytes. So,
"info_element[4]" would point to data which is beyond the memory
allocated for this pointer (that is, at x+8, while "info_element" has
been allocated only from x to x+7 (2 + 6 => 8 bytes)).

This patch rectifies this error by using "&info_element->data[4]" which
correctly copies the last two bytes of "data[]".

NOTE: The faulty line of code came from the following commit:

commit ecdfa44610fa ("Staging: add Realtek 8192 PCI wireless driver")

The above commit created the file `rtl8192e/ieee80211/ieee80211_rx.c`
which had the faulty line of code. This file has been deleted (or
possibly renamed) with the contents copied in to a new file
`rtl8192e/rtllib_rx.c` along with additional code in the commit
94a799425eee (tagged in Fixes).

Fixes: 94a799425eee ("From: wlanfae  [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
Cc: stable@vger.kernel.org
Signed-off-by: Atul Gopinathan 
Link: https://lore.kernel.org/r/20210323113413.29179-1-atulgopinathan@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: Fix possible buffer overflow in _rtl92e_wx_set_scan

2021-03-17T16:03:54+00:00

commit 8687bf9ef9551bcf93897e33364d121667b1aadf upstream.

Function _rtl92e_wx_set_scan calls memcpy without checking the length.
A user could control that length and trigger a buffer overflow.
Fix by checking the length is within the maximum allowed size.

Reviewed-by: Dan Carpenter 
Signed-off-by: Lee Gibson 
Cc: stable 
Link: https://lore.kernel.org/r/20210226145157.424065-1-leegib@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: fix potential use after free

2019-12-04T21:30:47+00:00

commit b7aa39a2ed0112d07fc277ebd24a08a7b2368ab9 upstream.

The variable skb is released via kfree_skb() when the return value of
_rtl92e_tx is not zero. However, after that, skb is accessed again to
read its length, which may result in a use after free bug. This patch
fixes the bug by moving the release operation to where skb is never
used later.

Signed-off-by: Pan Bian 
Reviewed-by: Dan Carpenter 
Cc: stable 
Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: remove unnecessary blank line

2019-09-05T07:37:31+00:00

Fix checkpath error "CHECK: Blank lines aren't necessary after an open
brace '{'"
in rtllib.h:482.

Signed-off-by: Beatriz Martins de Carvalho 
Link: https://lore.kernel.org/r/20190904210326.17983-1-martinsdecarvalhobeatriz@gmail.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: remove set but not used variable 'data_len'

2019-08-21T16:15:43+00:00

Fixes gcc '-Wunused-but-set-variable' warning:

 In function ieee80211_ccmp_encrypt:
drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c:162:6:
 warning: variable data_len set but not used [-Wunused-but-set-variable]

It is not used since commit 5ee5265674ce ("staging:
rtl8192e: rtllib_crypt_ccmp.c: Use crypto API ccm(aes)")

Reported-by: Hulk Robot 
Signed-off-by: YueHaibing 
Link: https://lore.kernel.org/r/20190821122802.44028-1-yuehaibing@huawei.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: remove two set but not used variables

2019-08-21T16:15:43+00:00

Fixes gcc '-Wunused-but-set-variable' warning:

 In function '_rtl92e_dm_tx_power_tracking_callback_tssi':
drivers/staging/rtl8192e/rtl8192e/rtl_dm.c:621:7:
 warning: variable 'bHighpowerstate' set but not used [-Wunused-but-set-variable]
 In function '_rtl92e_dm_rx_path_sel_byrssi':
drivers/staging/rtl8192e/rtl8192e/rtl_dm.c:1904:32:
 warning: variable 'cck_rx_ver2_min_index' set but not used [-Wunused-but-set-variable]

They are never used, so can be removed.

Reported-by: Hulk Robot 
Signed-off-by: YueHaibing 
Link: https://lore.kernel.org/r/20190821122556.37636-1-yuehaibing@huawei.com
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: rtllib_crypt_ccmp.c: Use crypto API ccm(aes)

2019-08-18T06:51:11+00:00

Use ccm(aes) aead transform instead of invoking the AES block cipher
block by block.

Signed-off-by: Christina Quast 
Reviewed-by: Ard Biesheuvel 
Link: https://lore.kernel.org/r/20190816065936.12214-3-contact@christina-quast.de
Signed-off-by: Greg Kroah-Hartman

staging: rtl8192e: Make use kmemdup

2019-08-05T15:11:33+00:00

As kmemdup API does kmalloc + memcpy . We can make use of it instead of
calling kmalloc and memcpy independetly.

Signed-off-by: Hariprasad Kelam 
Link: https://lore.kernel.org/r/20190804024832.GA14352@hari-Inspiron-1545
Signed-off-by: Greg Kroah-Hartman

Staging: rtl8192e: fixed a function prototype definition issue

2019-07-30T07:54:48+00:00

Added the identifier name in the function prototype definition.

Signed-off-by: Abhinav Jain 
Link: https://lore.kernel.org/r/20190726190146.10875-1-ubuntu@ip-172-31-129-142.ec2.internal
Signed-off-by: Greg Kroah-Hartman