niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

net: usb: pegasus: Check the return value of get_geristers() and friends;

Browse source 
Certain call sites of get_geristers() did not do proper error handling.  This
could be a problem as get_geristers() typically return the data via pointer to a
buffer.  If an error occurred the code is carelessly manipulating the wrong data.

Signed-off-by: Petko Manolov <petkan@nucleusys.com>
Reviewed-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Petko Manolov 2021-08-03 20:25:23 +03:00 • committed by David S. Miller
parent 13a9c4ac31
commit 8a160e2e9a
1 changed files with 75 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

106
drivers/net/usb/pegasus.c
View file

@ -132,9 +132,15 @@ static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size,
const void *data) const void *data)
{ {
return usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REGS, int ret;
ret = usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REGS,
PEGASUS_REQT_WRITE, 0, indx, data, size, PEGASUS_REQT_WRITE, 0, indx, data, size,
1000, GFP_NOIO); 1000, GFP_NOIO);
if (ret < 0)
netif_dbg(pegasus, drv, pegasus->net, "%s failed with %d\n", __func__, ret);
return ret;
} }
/* /*
@ -145,10 +151,15 @@ static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size,
static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data) static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data)
{ {
void *buf = &data; void *buf = &data;
int ret;
return usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REG, ret = usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REG,
PEGASUS_REQT_WRITE, data, indx, buf, 1, PEGASUS_REQT_WRITE, data, indx, buf, 1,
1000, GFP_NOIO); 1000, GFP_NOIO);
if (ret < 0)
netif_dbg(pegasus, drv, pegasus->net, "%s failed with %d\n", __func__, ret);
return ret;
} }
static int update_eth_regs_async(pegasus_t *pegasus) static int update_eth_regs_async(pegasus_t *pegasus)
@ -188,10 +199,9 @@ static int update_eth_regs_async(pegasus_t *pegasus)
static int __mii_op(pegasus_t *p, __u8 phy, __u8 indx, __u16 *regd, __u8 cmd) static int __mii_op(pegasus_t *p, __u8 phy, __u8 indx, __u16 *regd, __u8 cmd)
{ {
int i; int i, ret;
__u8 data[4] = { phy, 0, 0, indx };
__le16 regdi; __le16 regdi;
int ret = -ETIMEDOUT; __u8 data[4] = { phy, 0, 0, indx };
if (cmd & PHY_WRITE) { if (cmd & PHY_WRITE) {
__le16 *t = (__le16 *) & data[1]; __le16 *t = (__le16 *) & data[1];
@ -207,12 +217,15 @@ static int __mii_op(pegasus_t *p, __u8 phy, __u8 indx, __u16 *regd, __u8 cmd)
if (data[0] & PHY_DONE) if (data[0] & PHY_DONE)
break; break;
} }
if (i >= REG_TIMEOUT) if (i >= REG_TIMEOUT) {
ret = -ETIMEDOUT;
goto fail; goto fail;
}
if (cmd & PHY_READ) { if (cmd & PHY_READ) {
ret = get_registers(p, PhyData, 2, &regdi); ret = get_registers(p, PhyData, 2, &regdi);
if (ret < 0)
goto fail;
*regd = le16_to_cpu(regdi); *regd = le16_to_cpu(regdi);
return ret;
} }
return 0; return 0;
fail: fail:
@ -235,9 +248,13 @@ static int write_mii_word(pegasus_t *pegasus, __u8 phy, __u8 indx, __u16 *regd)
static int mdio_read(struct net_device *dev, int phy_id, int loc) static int mdio_read(struct net_device *dev, int phy_id, int loc)
{ {
pegasus_t *pegasus = netdev_priv(dev); pegasus_t *pegasus = netdev_priv(dev);
int ret;
u16 res; u16 res;
read_mii_word(pegasus, phy_id, loc, &res); ret = read_mii_word(pegasus, phy_id, loc, &res);
if (ret < 0)
return ret;
return (int)res; return (int)res;
} }
@ -251,10 +268,9 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val)
static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata) static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
{ {
int i; int ret, i;
__u8 tmp = 0;
__le16 retdatai; __le16 retdatai;
int ret; __u8 tmp = 0;
set_register(pegasus, EpromCtrl, 0); set_register(pegasus, EpromCtrl, 0);
set_register(pegasus, EpromOffset, index); set_register(pegasus, EpromOffset, index);
@ -262,21 +278,25 @@ static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata)
for (i = 0; i < REG_TIMEOUT; i++) { for (i = 0; i < REG_TIMEOUT; i++) {
ret = get_registers(pegasus, EpromCtrl, 1, &tmp); ret = get_registers(pegasus, EpromCtrl, 1, &tmp);
if (ret < 0)
goto fail;
if (tmp & EPROM_DONE) if (tmp & EPROM_DONE)
break; break;
if (ret == -ESHUTDOWN) }
if (i >= REG_TIMEOUT) {
ret = -ETIMEDOUT;
goto fail; goto fail;
} }
if (i >= REG_TIMEOUT)
goto fail;
ret = get_registers(pegasus, EpromData, 2, &retdatai); ret = get_registers(pegasus, EpromData, 2, &retdatai);
if (ret < 0)
goto fail;
*retdata = le16_to_cpu(retdatai); *retdata = le16_to_cpu(retdatai);
return ret; return ret;
fail: fail:
netif_warn(pegasus, drv, pegasus->net, "%s failed\n", __func__); netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
return -ETIMEDOUT; return ret;
} }
#ifdef PEGASUS_WRITE_EEPROM #ifdef PEGASUS_WRITE_EEPROM
@ -324,7 +344,7 @@ static int write_eprom_word(pegasus_t *pegasus, __u8 index, __u16 data)
return ret; return ret;
fail: fail:
netif_warn(pegasus, drv, pegasus->net, "%s failed\n", __func__); netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
return -ETIMEDOUT; return -ETIMEDOUT;
} }
#endif /* PEGASUS_WRITE_EEPROM */ #endif /* PEGASUS_WRITE_EEPROM */
@ -367,19 +387,21 @@ static void set_ethernet_addr(pegasus_t *pegasus)
return; return;
err: err:
eth_hw_addr_random(pegasus->net); eth_hw_addr_random(pegasus->net);
dev_info(&pegasus->intf->dev, "software assigned MAC address.\n"); netif_dbg(pegasus, drv, pegasus->net, "software assigned MAC address.\n");
return; return;
} }
static inline int reset_mac(pegasus_t *pegasus) static inline int reset_mac(pegasus_t *pegasus)
{ {
int ret, i;
__u8 data = 0x8; __u8 data = 0x8;
int i;
set_register(pegasus, EthCtrl1, data); set_register(pegasus, EthCtrl1, data);
for (i = 0; i < REG_TIMEOUT; i++) { for (i = 0; i < REG_TIMEOUT; i++) {
get_registers(pegasus, EthCtrl1, 1, &data); ret = get_registers(pegasus, EthCtrl1, 1, &data);
if (ret < 0)
goto fail;
if (~data & 0x08) { if (~data & 0x08) {
if (loopback) if (loopback)
break; break;
@ -402,22 +424,29 @@ static inline int reset_mac(pegasus_t *pegasus)
} }
if (usb_dev_id[pegasus->dev_index].vendor == VENDOR_ELCON) { if (usb_dev_id[pegasus->dev_index].vendor == VENDOR_ELCON) {
__u16 auxmode; __u16 auxmode;
read_mii_word(pegasus, 3, 0x1b, &auxmode); ret = read_mii_word(pegasus, 3, 0x1b, &auxmode);
if (ret < 0)
goto fail;
auxmode |= 4; auxmode |= 4;
write_mii_word(pegasus, 3, 0x1b, &auxmode); write_mii_word(pegasus, 3, 0x1b, &auxmode);
} }
return 0; return 0;
fail:
netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
return ret;
} }
static int enable_net_traffic(struct net_device *dev, struct usb_device *usb) static int enable_net_traffic(struct net_device *dev, struct usb_device *usb)
{ {
__u16 linkpart;
__u8 data[4];
pegasus_t *pegasus = netdev_priv(dev); pegasus_t *pegasus = netdev_priv(dev);
int ret; int ret;
__u16 linkpart;
__u8 data[4];
read_mii_word(pegasus, pegasus->phy, MII_LPA, &linkpart); ret = read_mii_word(pegasus, pegasus->phy, MII_LPA, &linkpart);
if (ret < 0)
goto fail;
data[0] = 0xc8; /* TX & RX enable, append status, no CRC */ data[0] = 0xc8; /* TX & RX enable, append status, no CRC */
data[1] = 0; data[1] = 0;
if (linkpart & (ADVERTISE_100FULL | ADVERTISE_10FULL)) if (linkpart & (ADVERTISE_100FULL | ADVERTISE_10FULL))
@ -435,11 +464,16 @@ static int enable_net_traffic(struct net_device *dev, struct usb_device *usb)
usb_dev_id[pegasus->dev_index].vendor == VENDOR_LINKSYS2 || usb_dev_id[pegasus->dev_index].vendor == VENDOR_LINKSYS2 ||
usb_dev_id[pegasus->dev_index].vendor == VENDOR_DLINK) { usb_dev_id[pegasus->dev_index].vendor == VENDOR_DLINK) {
u16 auxmode; u16 auxmode;
read_mii_word(pegasus, 0, 0x1b, &auxmode); ret = read_mii_word(pegasus, 0, 0x1b, &auxmode);
if (ret < 0)
goto fail;
auxmode |= 4; auxmode |= 4;
write_mii_word(pegasus, 0, 0x1b, &auxmode); write_mii_word(pegasus, 0, 0x1b, &auxmode);
} }
return 0;
fail:
netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
return ret; return ret;
} }
@ -447,9 +481,9 @@ static void read_bulk_callback(struct urb *urb)
{ {
pegasus_t *pegasus = urb->context; pegasus_t *pegasus = urb->context;
struct net_device *net; struct net_device *net;
u8 *buf = urb->transfer_buffer;
int rx_status, count = urb->actual_length; int rx_status, count = urb->actual_length;
int status = urb->status; int status = urb->status;
u8 *buf = urb->transfer_buffer;
__u16 pkt_len; __u16 pkt_len;
if (!pegasus) if (!pegasus)
@ -998,8 +1032,7 @@ static int pegasus_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
data[0] = pegasus->phy; data[0] = pegasus->phy;
fallthrough; fallthrough;
case SIOCDEVPRIVATE + 1: case SIOCDEVPRIVATE + 1:
read_mii_word(pegasus, data[0], data[1] & 0x1f, &data[3]); res = read_mii_word(pegasus, data[0], data[1] & 0x1f, &data[3]);
res = 0;
break; break;
case SIOCDEVPRIVATE + 2: case SIOCDEVPRIVATE + 2:
if (!capable(CAP_NET_ADMIN)) if (!capable(CAP_NET_ADMIN))
@ -1033,22 +1066,25 @@ static void pegasus_set_multicast(struct net_device *net)
static __u8 mii_phy_probe(pegasus_t *pegasus) static __u8 mii_phy_probe(pegasus_t *pegasus)
{ {
int i; int i, ret;
__u16 tmp; __u16 tmp;
for (i = 0; i < 32; i++) { for (i = 0; i < 32; i++) {
read_mii_word(pegasus, i, MII_BMSR, &tmp); ret = read_mii_word(pegasus, i, MII_BMSR, &tmp);
if (ret < 0)
goto fail;
if (tmp == 0 || tmp == 0xffff || (tmp & BMSR_MEDIA) == 0) if (tmp == 0 || tmp == 0xffff || (tmp & BMSR_MEDIA) == 0)
continue; continue;
else else
return i; return i;
} }
fail:
return 0xff; return 0xff;
} }
static inline void setup_pegasus_II(pegasus_t *pegasus) static inline void setup_pegasus_II(pegasus_t *pegasus)
{ {
int ret;
__u8 data = 0xa5; __u8 data = 0xa5;
set_register(pegasus, Reg1d, 0); set_register(pegasus, Reg1d, 0);
@ -1060,7 +1096,9 @@ static inline void setup_pegasus_II(pegasus_t *pegasus)
set_register(pegasus, Reg7b, 2); set_register(pegasus, Reg7b, 2);
set_register(pegasus, 0x83, data); set_register(pegasus, 0x83, data);
get_registers(pegasus, 0x83, 1, &data); ret = get_registers(pegasus, 0x83, 1, &data);
if (ret < 0)
goto fail;
if (data == 0xa5) if (data == 0xa5)
pegasus->chip = 0x8513; pegasus->chip = 0x8513;
@ -1075,6 +1113,10 @@ static inline void setup_pegasus_II(pegasus_t *pegasus)
set_register(pegasus, Reg81, 6); set_register(pegasus, Reg81, 6);
else else
set_register(pegasus, Reg81, 2); set_register(pegasus, Reg81, 2);
return;
fail:
netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__);
} }
static void check_carrier(struct work_struct *work) static void check_carrier(struct work_struct *work)