[PATCH 61/74] staging: rtl8723au: Move dummy_event_callback() to rtw_mlme_ext.c

2014-05-21 Thread Jes . Sorensen 
From: Jes Sorensen jes.soren...@redhat.com

In addition get rid of a couple of empty *_event_callback() handlers
and use dummy_event_callback() instead.

Signed-off-by: Jes Sorensen jes.soren...@redhat.com
---
 drivers/staging/rtl8723au/core/rtw_mlme.c| 14 --
 drivers/staging/rtl8723au/core/rtw_mlme_ext.c| 14 +-
 drivers/staging/rtl8723au/include/rtw_mlme.h |  3 ---
 drivers/staging/rtl8723au/include/rtw_mlme_ext.h |  3 ---
 4 files changed, 9 insertions(+), 25 deletions(-)

diff --git a/drivers/staging/rtl8723au/core/rtw_mlme.c 
b/drivers/staging/rtl8723au/core/rtw_mlme.c
index da25485..148e11f 100644
--- a/drivers/staging/rtl8723au/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723au/core/rtw_mlme.c
@@ -818,14 +818,6 @@ rtw_surveydone_event_callback23a(struct rtw_adapter 
*adapter, const u8 *pbuf)
rtw_cfg80211_surveydone_event_callback(adapter);
 }
 
-void rtw_dummy_event_callback23a(struct rtw_adapter *adapter, const u8 *pbuf)
-{
-}
-
-void rtw23a_fwdbg_event_callback(struct rtw_adapter *adapter, const u8 *pbuf)
-{
-}
-
 static void free_scanqueue(struct mlme_priv *pmlmepriv)
 {
struct wlan_network *pnetwork;
@@ -1540,12 +1532,6 @@ void rtw_stadel_event_callback23a(struct rtw_adapter 
*adapter, const u8 *pbuf)
spin_unlock_bh(pmlmepriv-lock);
 }
 
-void rtw_cpwm_event_callback23a(struct rtw_adapter *padapter, const u8 *pbuf)
-{
-   RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
-(+rtw_cpwm_event_callback23a !!!\n));
-}
-
 /*
 * rtw23a_join_to_handler - Timeout/faliure handler for CMD JoinBss
 * @adapter: pointer to _adapter structure
diff --git a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c 
b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
index bc70548..58ff635 100644
--- a/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723au/core/rtw_mlme_ext.c
@@ -235,9 +235,13 @@ static struct rt_channel_plan_map  
RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
 
 static struct rt_channel_plan_map  RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = 
{0x03, 0x02}; /* use the conbination for max channel numbers */
 
+static void dummy_event_callback(struct rtw_adapter *adapter, const u8 *pbuf)
+{
+}
+
 static struct fwevent wlanevents[] =
 {
-   {0, rtw_dummy_event_callback23a},   /*0*/
+   {0, dummy_event_callback}, /*0*/
{0, NULL},
{0, NULL},
{0, NULL},
@@ -251,17 +255,17 @@ static struct fwevent wlanevents[] =
{0, rtw23a_joinbss_event_cb},  /*10*/
{sizeof(struct stassoc_event), rtw_stassoc_event_callback23a},
{sizeof(struct stadel_event), rtw_stadel_event_callback23a},
-   {0, rtw_atimdone_event_callback23a},
-   {0, rtw_dummy_event_callback23a},
+   {0, dummy_event_callback},
+   {0, dummy_event_callback},
{0, NULL},  /*15*/
{0, NULL},
{0, NULL},
{0, NULL},
-   {0, rtw23a_fwdbg_event_callback},
+   {0, dummy_event_callback},
{0, NULL},   /*20*/
{0, NULL},
{0, NULL},
-   {0, rtw_cpwm_event_callback23a},
+   {0, dummy_event_callback},
{0, NULL},
 };
 
diff --git a/drivers/staging/rtl8723au/include/rtw_mlme.h 
b/drivers/staging/rtl8723au/include/rtw_mlme.h
index 2b72d5b..b1f2b5f 100644
--- a/drivers/staging/rtl8723au/include/rtw_mlme.h
+++ b/drivers/staging/rtl8723au/include/rtw_mlme.h
@@ -338,9 +338,6 @@ void rtw_surveydone_event_callback23a(struct rtw_adapter 
*adapter, const u8 *pbu
 void rtw23a_joinbss_event_cb(struct rtw_adapter *adapter, const u8 *pbuf);
 void rtw_stassoc_event_callback23a(struct rtw_adapter *adapter, const u8 
*pbuf);
 void rtw_stadel_event_callback23a(struct rtw_adapter *adapter, const u8 *pbuf);
-void rtw_atimdone_event_callback23a(struct rtw_adapter *adapter, const u8 
*pbuf);
-void rtw_cpwm_event_callback23a(struct rtw_adapter *adapter, const u8 *pbuf);
-
 
 int event_thread(void *context);
 void rtw23a_join_to_handler(unsigned long);
diff --git a/drivers/staging/rtl8723au/include/rtw_mlme_ext.h 
b/drivers/staging/rtl8723au/include/rtw_mlme_ext.h
index b5f3dbb..afbd807 100644
--- a/drivers/staging/rtl8723au/include/rtw_mlme_ext.h
+++ b/drivers/staging/rtl8723au/include/rtw_mlme_ext.h
@@ -670,9 +670,6 @@ struct C2HEvent_Header {
unsigned int rsvd;
 };
 
-void rtw_dummy_event_callback23a(struct rtw_adapter *adapter, const u8 *pbuf);
-void rtw23a_fwdbg_event_callback(struct rtw_adapter *adapter, const u8 *pbuf);
-
 enum rtw_c2h_event {
GEN_EVT_CODE(_Read_MACREG) = 0, /*0*/
GEN_EVT_CODE(_Read_BBREG),
-- 
1.9.0

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH 61/74] staging: rtl8723au: Move dummy_event_callback() to rtw_mlme_ext.c

2014-05-21 Thread Dan Carpenter 
This comment is not related to your patch.

On Wed, May 21, 2014 at 09:38:25AM +0200, jes.soren...@redhat.com wrote:
  static struct fwevent wlanevents[] =
  {
 - {0, rtw_dummy_event_callback23a},   /*0*/
 + {0, dummy_event_callback}, /*0*/
   {0, NULL},
   {0, NULL},

These are called from mlme_evt_hdl23a(), that code looks like this:

drivers/staging/rtl8723au/core/rtw_mlme_ext.c
  6407  int mlme_evt_hdl23a(struct rtw_adapter *padapter, const u8 *pbuf)
  6408  {
  6409  u8 evt_code, evt_seq;
  6410  u16 evt_sz;
  6411  const struct C2HEvent_Header *c2h;
  6412  void (*event_callback)(struct rtw_adapter *dev, const u8 *pbuf);
  6413  
  6414  c2h = (struct C2HEvent_Header *)pbuf;
  6415  evt_sz = c2h-len;
  6416  evt_seq = c2h-seq;
  6417  evt_code = c2h-ID;
  6418  
  6419  /*  checking if event code is valid */
  6420  if (evt_code = MAX_C2HEVT) {
  6421  RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, (\nEvent 
Code(%d) mismatch!\n, evt_code));
  6422  goto _abort_event_;
  6423  }
  6424  
  6425  /*  checking if event size match the event parm size */
  6426  if ((wlanevents[evt_code].parmsize != 0) 
  6427  (wlanevents[evt_code].parmsize != evt_sz)) {
  6428  RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, 
(\nEvent(%d) Parm Size mismatch (%d vs %d)!\n,
  6429  evt_code, wlanevents[evt_code].parmsize, 
evt_sz));
  6430  goto _abort_event_;
  6431  }
  6432  
  6433  event_callback = wlanevents[evt_code].event_callback;

There should be a check for:

if (!event_callback)
return H2C_SUCCESS;

Because that array is full of NULL pointers.

  6434  event_callback(padapter, pbuf + sizeof(struct C2HEvent_Header));
  6435  
  6436  _abort_event_:
  6437  
  6438  return H2C_SUCCESS;
  6439  }

I have invented a new tag called TODO-list: so I can do
`grep ^TODO-list: inbox` and find a TODO list of things to work on.

TODO-list: 2014-05-21: rtl8723au: potential NULL deref in mlme_evt_hdl23a()

regards,
dan carpenter

___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: [PATCH 61/74] staging: rtl8723au: Move dummy_event_callback() to rtw_mlme_ext.c

2014-05-21 Thread Jes Sorensen 
Dan Carpenter dan.carpen...@oracle.com writes:
 This comment is not related to your patch.

 On Wed, May 21, 2014 at 09:38:25AM +0200, jes.soren...@redhat.com wrote:
  static struct fwevent wlanevents[] =
  {
 -{0, rtw_dummy_event_callback23a},   /*0*/
 +{0, dummy_event_callback}, /*0*/
  {0, NULL},
  {0, NULL},

 These are called from mlme_evt_hdl23a(), that code looks like this:

 drivers/staging/rtl8723au/core/rtw_mlme_ext.c
   6407  int mlme_evt_hdl23a(struct rtw_adapter *padapter, const u8 *pbuf)
   6408  {
   6409  u8 evt_code, evt_seq;
   6410  u16 evt_sz;
   6411  const struct C2HEvent_Header *c2h;
   6412  void (*event_callback)(struct rtw_adapter *dev, const u8 
 *pbuf);
   6413  
   6414  c2h = (struct C2HEvent_Header *)pbuf;
   6415  evt_sz = c2h-len;
   6416  evt_seq = c2h-seq;
   6417  evt_code = c2h-ID;
   6418  
   6419  /*  checking if event code is valid */
   6420  if (evt_code = MAX_C2HEVT) {
   6421  RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, (\nEvent 
 Code(%d) mismatch!\n, evt_code));
   6422  goto _abort_event_;
   6423  }
   6424  
   6425  /*  checking if event size match the event parm size */
   6426  if ((wlanevents[evt_code].parmsize != 0) 
   6427  (wlanevents[evt_code].parmsize != evt_sz)) {
   6428  RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, 
 (\nEvent(%d) Parm Size mismatch (%d vs %d)!\n,
   6429  evt_code, wlanevents[evt_code].parmsize, 
 evt_sz));
   6430  goto _abort_event_;
   6431  }
   6432  
   6433  event_callback = wlanevents[evt_code].event_callback;

 There should be a check for:

   if (!event_callback)
   return H2C_SUCCESS;

 Because that array is full of NULL pointers.


Seems fair - if you do a TODO list for this, you may want to add the
8188eu driver to the list. I would expect it to have the same problem.

Cheers,
Jes
___
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel