d4c999bb89
backport from wireless-drivers-next, replacing some existing patches in our tree (marked with '=' are those which were already present): f483039cf51a rt2x00: use simple_read_from_buffer() =5c656c71b1bf rt2800: move usb specific txdone/txstatus routines to rt2800lib =0b0d556e0ebb rt2800mmio: use txdone/txstatus routines from lib =5022efb50f62 rt2x00: do not check for txstatus timeout every time on tasklet =adf26a356f13 rt2x00: use different txstatus timeouts when flushing =0240564430c0 rt2800: flush and txstatus rework for rt2800mmio 6eba8fd22352 rt2x00: rt2400pci: mark expected switch fall-through 10bb92217747 rt2x00: rt2500pci: mark expected switch fall-through 916e6bbcfcff rt2x00: rt2800lib: mark expected switch fall-throughs 641dd8068ecb rt2x00: rt61pci: mark expected switch fall-through 750afb08ca71 cross-tree: phase out dma_zalloc_coherent() =c2e28ef7711f rt2x00: reduce tx power to nominal level on RT6352 a4296994eb80 rt2x00: Work around a firmware bug with shared keys 2587791d5758 rt2x00: no need to check return value of debugfs_create functions pending on linux-wireless: rt2x00: remove unneeded check rt2x00: remove confusing AGC register rt2800: enable TX_PIN_CFG_LNA_PE_ bits per band rt2800: enable TX_PIN_CFG_RFRX_EN only for MT7620 rt2800: comment and simplify AGC init for RT6352 rt2x00: do not print error when queue is full rt2800: partially restore old mmio txstatus behaviour rt2800: new flush implementation for SoC devices rt2800: move txstatus pending routine rt2800mmio: fetch tx status changes rt2800mmio: use timer and work for handling tx statuses timeouts rt2x00: remove last_nostatus_check rt2x00: remove not used entry field rt2x00mmio: remove legacy comment While at it also rename some existing patches now that there are separate folders with patches for each driver to make things a bit nicer to handle. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
59 lines
2 KiB
Diff
59 lines
2 KiB
Diff
From f483039cf51acf30494cd754194562c22cf98764 Mon Sep 17 00:00:00 2001
|
|
From: Dan Carpenter <dan.carpenter@oracle.com>
|
|
Date: Wed, 22 Aug 2018 13:41:26 +0300
|
|
Subject: [PATCH 01/28] rt2x00: use simple_read_from_buffer()
|
|
|
|
The problem with this copy_to_user() calls is that they don't ensure
|
|
that "size" is less than the "length" which the user provided.
|
|
|
|
Obviously, this is debugfs and "size" is normally going to be very small
|
|
so it probably doesn't matter, but this is the correct thing to do.
|
|
|
|
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
|
|
Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
|
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
|
---
|
|
.../net/wireless/ralink/rt2x00/rt2x00debug.c | 18 +++---------------
|
|
1 file changed, 3 insertions(+), 15 deletions(-)
|
|
|
|
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
|
|
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
|
|
@@ -464,11 +464,7 @@ static ssize_t rt2x00debug_read_##__name
|
|
\
|
|
size = sprintf(line, __format, value); \
|
|
\
|
|
- if (copy_to_user(buf, line, size)) \
|
|
- return -EFAULT; \
|
|
- \
|
|
- *offset += size; \
|
|
- return size; \
|
|
+ return simple_read_from_buffer(buf, length, offset, line, size); \
|
|
}
|
|
|
|
#define RT2X00DEBUGFS_OPS_WRITE(__name, __type) \
|
|
@@ -545,11 +541,7 @@ static ssize_t rt2x00debug_read_dev_flag
|
|
|
|
size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->flags);
|
|
|
|
- if (copy_to_user(buf, line, size))
|
|
- return -EFAULT;
|
|
-
|
|
- *offset += size;
|
|
- return size;
|
|
+ return simple_read_from_buffer(buf, length, offset, line, size);
|
|
}
|
|
|
|
static const struct file_operations rt2x00debug_fop_dev_flags = {
|
|
@@ -574,11 +566,7 @@ static ssize_t rt2x00debug_read_cap_flag
|
|
|
|
size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->cap_flags);
|
|
|
|
- if (copy_to_user(buf, line, size))
|
|
- return -EFAULT;
|
|
-
|
|
- *offset += size;
|
|
- return size;
|
|
+ return simple_read_from_buffer(buf, length, offset, line, size);
|
|
}
|
|
|
|
static const struct file_operations rt2x00debug_fop_cap_flags = {
|