[PATCH] [v2] netfilter: ipset: fix a missing check of nla_parse
When nla_parse fails, we should not use the results (the first
argument). The fix checks if it fails, and if so, returns its error code
upstream.
Signed-off-by: Aditya Pakki
---
net/netfilter/ipset/ip_set_core.c | 9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c
b/net/netfilter/ipset/ip_set_core.c
index 45a257695bef..3ee0fda05a3b 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1546,8 +1546,13 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct
ip_set *set,
memcpy(>msg, nlh, nlh->nlmsg_len);
cmdattr = (void *)>msg + min_len;
- nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
- nlh->nlmsg_len - min_len, ip_set_adt_policy, NULL);
+ ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
+ nlh->nlmsg_len - min_len, ip_set_adt_policy,
+ NULL);
+ if (ret) {
+ nlmsg_free(skb2);
+ return ret;
+ }
errline = nla_data(cda[IPSET_ATTR_LINENO]);
--
2.17.1
[PATCH] Staging: rts5208: Fix error handling on rtsx_send_cmd
In sd_execute_write_data, the rtsx_send_cmd could fail with ETIMEDOUT
or EIO. The fix adds a check to handle these failures.
Signed-off-by: Aditya Pakki
---
drivers/staging/rts5208/sd.c | 7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
index 2c47ae613ea1..c256a2398651 100644
--- a/drivers/staging/rts5208/sd.c
+++ b/drivers/staging/rts5208/sd.c
@@ -4437,7 +4437,12 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct
rtsx_chip *chip)
rtsx_init_cmd(chip);
rtsx_add_cmd(chip, CHECK_REG_CMD, 0xFD30, 0x02, 0x02);
- rtsx_send_cmd(chip, SD_CARD, 250);
+ retval = rtsx_send_cmd(chip, SD_CARD, 250);
+ if (retval < 0) {
+ write_err = true;
+ rtsx_clear_sd_error(chip);
+ goto sd_execute_write_cmd_failed;
+ }
retval = sd_update_lock_status(chip);
if (retval != STATUS_SUCCESS) {
--
2.17.1
[PATCH] ASoC: rt5663: Fix error handling of device_property_read_u32_array
In rt5663_parse_dp, the function device_property_read_u32_array() can
return an error. This fix adds a check to the latter as well as to the
callsite of rt5663_parse_dp in rt5663_i2c_probe.
Signed-off-by: Aditya Pakki
---
sound/soc/codecs/rt5663.c | 9 ++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
index da6647015708..2678842d8cd4 100644
--- a/sound/soc/codecs/rt5663.c
+++ b/sound/soc/codecs/rt5663.c
@@ -3480,7 +3480,7 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663,
struct device *dev)
table_size = sizeof(struct impedance_mapping_table) *
rt5663->pdata.impedance_sensing_num;
rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL);
- device_property_read_u32_array(dev,
+ return device_property_read_u32_array(dev,
"realtek,impedance_sensing_table",
(u32 *)rt5663->imp_table, table_size);
}
@@ -3507,8 +3507,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c,
if (pdata)
rt5663->pdata = *pdata;
- else
- rt5663_parse_dp(rt5663, >dev);
+ else {
+ ret = rt5663_parse_dp(rt5663, >dev);
+ if (ret)
+ return ret;
+ }
for (i = 0; i < ARRAY_SIZE(rt5663->supplies); i++)
rt5663->supplies[i].supply = rt5663_supply_names[i];
--
2.17.1
[PATCH] dmaengine: qcom_hidma: Check for driver register failure
While initializing the driver, the function platform_driver_register can
fail and return an error. Consistent with other invocations, this patch
returns the error upstream.
Signed-off-by: Aditya Pakki
---
drivers/dma/qcom/hidma_mgmt.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c
index d64edeb6771a..681de12f4c67 100644
--- a/drivers/dma/qcom/hidma_mgmt.c
+++ b/drivers/dma/qcom/hidma_mgmt.c
@@ -423,9 +423,8 @@ static int __init hidma_mgmt_init(void)
hidma_mgmt_of_populate_channels(child);
}
#endif
- platform_driver_register(_mgmt_driver);
+ return platform_driver_register(_mgmt_driver);
- return 0;
}
module_init(hidma_mgmt_init);
MODULE_LICENSE("GPL v2");
--
2.17.1
[PATCH] mfd: sm501: Check for driver register failure
While initializing the driver, the function platform_driver_register can
fail and return an error. Consistent with other invocations, this patch
returns the error upstream.
Signed-off-by: Aditya Pakki
---
drivers/mfd/sm501.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
index a530972c5a7e..62cf62636ae6 100644
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -1729,7 +1729,11 @@ static struct platform_driver sm501_plat_driver = {
static int __init sm501_base_init(void)
{
- platform_driver_register(_plat_driver);
+ int rc;
+
+ rc = platform_driver_register(_plat_driver);
+ if (rc)
+ return rc;
return pci_register_driver(_pci_driver);
}
--
2.17.1
[PATCH] bluetooth: hci_intel: Check for driver register failure
While initializing the driver, the function platform_driver_register can
fail and return an error. Consistent with other invocations, this patch
returns the error upstream.
Signed-off-by: Aditya Pakki
---
drivers/bluetooth/hci_intel.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index f31410526c57..8450389a2017 100644
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -1242,7 +1242,11 @@ static struct platform_driver intel_driver = {
int __init intel_init(void)
{
- platform_driver_register(_driver);
+ int rc;
+
+ rc = platform_driver_register(_driver);
+ if (rc)
+ return rc;
return hci_uart_register_proto(_proto);
}
--
2.17.1
[PATCH] bluetooth: hci_bcm: Check for driver_register failure
While initializing the driver, the function platform_driver_register can fail and return an error. Consistent with other invocations, this patch returns the error upstream. Signed-off-by: Aditya Pakki --- drivers/bluetooth/hci_bcm.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c index ddbe518c3e5b..f5ddb0f19c31 100644 --- a/drivers/bluetooth/hci_bcm.c +++ b/drivers/bluetooth/hci_bcm.c @@ -1442,7 +1442,12 @@ int __init bcm_init(void) /* For now, we need to keep both platform device * driver (ACPI generated) and serdev driver (DT). */ - platform_driver_register(_driver); + int rc; + + rc = platform_driver_register(_driver); + if (rc) + return rc; + serdev_device_driver_register(_serdev_driver); return hci_uart_register_proto(_proto); -- 2.17.1
[PATCH] dmaengine: stm32-mdma: Add a check on read_u32_array
In stm32_mdma_probe, after reading the property "st,ahb-addr-masks", the second call is not checked for failure. This time of check to time of use case of "count" error is sent upstream. Signed-off-by: Aditya Pakki --- drivers/dma/stm32-mdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c index 390e4cae0e1a..485dea177704 100644 --- a/drivers/dma/stm32-mdma.c +++ b/drivers/dma/stm32-mdma.c @@ -1579,9 +1579,11 @@ static int stm32_mdma_probe(struct platform_device *pdev) dmadev->nr_channels = nr_channels; dmadev->nr_requests = nr_requests; - device_property_read_u32_array(>dev, "st,ahb-addr-masks", + ret = device_property_read_u32_array(>dev, "st,ahb-addr-masks", dmadev->ahb_addr_masks, count); + if (ret) + return ret; dmadev->nr_ahb_addr_masks = count; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- 2.17.1
[PATCH] media: gspca: mt9m111: Check write_bridge for timeout
In mt9m111_probe, m5602_write_bridge can timeout and return a negative
error value. The fix checks for this error and passes it upstream.
Signed-off-by: Aditya Pakki
---
drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 8 +---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
index c9947c4a0f63..8fac814f4779 100644
--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
+++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c
@@ -199,7 +199,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg =
{
int mt9m111_probe(struct sd *sd)
{
u8 data[2] = {0x00, 0x00};
- int i;
+ int i, rc = 0;
struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
if (force_sensor) {
@@ -217,16 +217,18 @@ int mt9m111_probe(struct sd *sd)
/* Do the preinit */
for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) {
if (preinit_mt9m111[i][0] == BRIDGE) {
- m5602_write_bridge(sd,
+ rc |= m5602_write_bridge(sd,
preinit_mt9m111[i][1],
preinit_mt9m111[i][2]);
} else {
data[0] = preinit_mt9m111[i][2];
data[1] = preinit_mt9m111[i][3];
- m5602_write_sensor(sd,
+ rc |= m5602_write_sensor(sd,
preinit_mt9m111[i][1], data, 2);
}
}
+ if (rc < 0)
+ return rc;
if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2))
return -ENODEV;
--
2.17.1
[PATCH] media: gspca: Check the return value of write_bridge for timeout
In po1030_probe(), m5602_write_bridge() can timeout and return an error
value. The fix checks for the return value and propagates upstream
consistent with other usb drivers.
Signed-off-by: Aditya Pakki
---
drivers/media/usb/gspca/m5602/m5602_po1030.c | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c
b/drivers/media/usb/gspca/m5602/m5602_po1030.c
index 37d2891e5f5b..5e43b4782f02 100644
--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c
+++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c
@@ -158,6 +158,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {
int po1030_probe(struct sd *sd)
{
+ int rc = 0;
u8 dev_id_h = 0, i;
struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;
@@ -177,11 +178,14 @@ int po1030_probe(struct sd *sd)
for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) {
u8 data = preinit_po1030[i][2];
if (preinit_po1030[i][0] == SENSOR)
- m5602_write_sensor(sd,
+ rc |= m5602_write_sensor(sd,
preinit_po1030[i][1], , 1);
else
- m5602_write_bridge(sd, preinit_po1030[i][1], data);
+ rc |= m5602_write_bridge(sd, preinit_po1030[i][1],
+ data);
}
+ if (rc < 0)
+ return rc;
if (m5602_read_sensor(sd, PO1030_DEVID_H, _id_h, 1))
return -ENODEV;
--
2.17.1
[PATCH] rtc: rv8803: Check return value of rv8803_write_reg
In rv8803_handle_irq, rv8803_write_reg can return a failed return
value when attempting to write to the bus. The fix checks the output
and throws a dev_warn notifying of the failure.
Signed-off-by: Aditya Pakki
---
drivers/rtc/rtc-rv8803.c | 9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/rtc/rtc-rv8803.c b/drivers/rtc/rtc-rv8803.c
index 450a0b831a2d..5a19d5ecbf57 100644
--- a/drivers/rtc/rtc-rv8803.c
+++ b/drivers/rtc/rtc-rv8803.c
@@ -180,8 +180,13 @@ static irqreturn_t rv8803_handle_irq(int irq, void *dev_id)
if (events) {
rtc_update_irq(rv8803->rtc, 1, events);
- rv8803_write_reg(client, RV8803_FLAG, flags);
- rv8803_write_reg(rv8803->client, RV8803_CTRL, rv8803->ctrl);
+ if (rv8803_write_reg(client, RV8803_FLAG, flags))
+ dev_warn(>dev, "Failed to write RV8803 reg.\n");
+
+ if (rv8803_write_reg(rv8803->client, RV8803_CTRL,
+ rv8803->ctrl))
+ dev_warn(>client->dev,
+ "Failed to write RV8803_CTRL reg.\n");
}
mutex_unlock(>flags_lock);
--
2.17.1
[PATCH] iio: adc: xilinx: check return value of xadc_write_adc_reg
In function xadc_probe, xadc_write_adc_reg can return an error value when write fails. The fix checks for the return value consistent with other invocations of the latter function. Signed-off-by: Aditya Pakki --- drivers/iio/adc/xilinx-xadc-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 3f6be5ac049a..b13c61539d46 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1273,8 +1273,10 @@ static int xadc_probe(struct platform_device *pdev) xadc->threshold[i] = 0x; else xadc->threshold[i] = 0; - xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), + ret = xadc_write_adc_reg(xadc, XADC_REG_THRESHOLD(i), xadc->threshold[i]); + if (ret) + goto err_free_irq; } /* Go to non-buffered mode */ -- 2.17.1
[PATCH] staging: rts5208: Add a check for ms_read_extra_data
In ms_copy_page, the function ms_read_extra_data may fail for many reasons. The fix adds a check similar to other invocation to return error upstream. Signed-off-by: Aditya Pakki --- drivers/staging/rts5208/ms.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c index 04b588b8b376..8eb6221e4cc8 100644 --- a/drivers/staging/rts5208/ms.c +++ b/drivers/staging/rts5208/ms.c @@ -1676,7 +1676,10 @@ static int ms_copy_page(struct rtsx_chip *chip, u16 old_blk, u16 new_blk, return STATUS_FAIL; } - ms_read_extra_data(chip, old_blk, i, extra, MS_EXTRA_SIZE); + retval = ms_read_extra_data(chip, old_blk, i, extra, + MS_EXTRA_SIZE); + if (retval != STATUS_SUCCESS) + return STATUS_FAIL; retval = ms_set_rw_reg_addr(chip, OverwriteFlag, MS_EXTRA_SIZE, SystemParm, 6); -- 2.17.1
[PATCH] media: dvb: Add check on sp8870_readreg
In sp8870_set_frontend_parameters, the function sp8870_readreg may return an error when i2c_transfer fails. The fix checks for this error and returns upstream consistent with other invocations. Signed-off-by: Aditya Pakki --- drivers/media/dvb-frontends/sp8870.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c index 8d31cf3f4f07..270a3c559e08 100644 --- a/drivers/media/dvb-frontends/sp8870.c +++ b/drivers/media/dvb-frontends/sp8870.c @@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) sp8870_writereg(state, 0xc05, reg0xc05); // read status reg in order to clear pending irqs - sp8870_readreg(state, 0x200); + err = sp8870_readreg(state, 0x200); + if (err) + return err; // system controller start sp8870_microcontroller_start(state); -- 2.17.1
[PATCH] media: dvb: add return value check on Write16
Write16 can return an error code -1 when the i2c_write fails. The
fix checks for these failures and returns the error upstream
Signed-off-by: Aditya Pakki
---
drivers/media/dvb-frontends/drxd_hard.c | 30 -
1 file changed, 19 insertions(+), 11 deletions(-)
diff --git a/drivers/media/dvb-frontends/drxd_hard.c
b/drivers/media/dvb-frontends/drxd_hard.c
index 684d428efb0d..0a5b15bee1d7 100644
--- a/drivers/media/dvb-frontends/drxd_hard.c
+++ b/drivers/media/dvb-frontends/drxd_hard.c
@@ -1144,6 +1144,8 @@ static int EnableAndResetMB(struct drxd_state *state)
static int InitCC(struct drxd_state *state)
{
+ int status = 0;
+
if (state->osc_clock_freq == 0 ||
state->osc_clock_freq > 2 ||
(state->osc_clock_freq % 4000) != 0) {
@@ -1151,14 +1153,17 @@ static int InitCC(struct drxd_state *state)
return -1;
}
- Write16(state, CC_REG_OSC_MODE__A, CC_REG_OSC_MODE_M20, 0);
- Write16(state, CC_REG_PLL_MODE__A, CC_REG_PLL_MODE_BYPASS_PLL |
- CC_REG_PLL_MODE_PUMP_CUR_12, 0);
- Write16(state, CC_REG_REF_DIVIDE__A, state->osc_clock_freq / 4000, 0);
- Write16(state, CC_REG_PWD_MODE__A, CC_REG_PWD_MODE_DOWN_PLL, 0);
- Write16(state, CC_REG_UPDATE__A, CC_REG_UPDATE_KEY, 0);
+ status |= Write16(state, CC_REG_OSC_MODE__A, CC_REG_OSC_MODE_M20, 0);
+ status |= Write16(state, CC_REG_PLL_MODE__A,
+ CC_REG_PLL_MODE_BYPASS_PLL |
+ CC_REG_PLL_MODE_PUMP_CUR_12, 0);
+ status |= Write16(state, CC_REG_REF_DIVIDE__A,
+ state->osc_clock_freq / 4000, 0);
+ status |= Write16(state, CC_REG_PWD_MODE__A, CC_REG_PWD_MODE_DOWN_PLL,
+ 0);
+ status |= Write16(state, CC_REG_UPDATE__A, CC_REG_UPDATE_KEY, 0);
- return 0;
+ return status;
}
static int ResetECOD(struct drxd_state *state)
@@ -1312,7 +1317,10 @@ static int SC_SendCommand(struct drxd_state *state, u16
cmd)
int status = 0, ret;
u16 errCode;
- Write16(state, SC_RA_RAM_CMD__A, cmd, 0);
+ status = Write16(state, SC_RA_RAM_CMD__A, cmd, 0);
+ if (status < 0)
+ return status;
+
SC_WaitForReady(state);
ret = Read16(state, SC_RA_RAM_CMD_ADDR__A, , 0);
@@ -1339,9 +1347,9 @@ static int SC_ProcStartCommand(struct drxd_state *state,
break;
}
SC_WaitForReady(state);
- Write16(state, SC_RA_RAM_CMD_ADDR__A, subCmd, 0);
- Write16(state, SC_RA_RAM_PARAM1__A, param1, 0);
- Write16(state, SC_RA_RAM_PARAM0__A, param0, 0);
+ status |= Write16(state, SC_RA_RAM_CMD_ADDR__A, subCmd, 0);
+ status |= Write16(state, SC_RA_RAM_PARAM1__A, param1, 0);
+ status |= Write16(state, SC_RA_RAM_PARAM0__A, param0, 0);
SC_SendCommand(state, SC_RA_RAM_CMD_PROC_START);
} while (0);
--
2.17.1
[PATCH] mm: compaction.c: Propagate return value upstream
In sysctl_extfrag_handler(), proc_dointvec_minmax() can return an
error. The fix propagates the error upstream in case of failure.
Signed-off-by: Aditya Pakki
---
mm/compaction.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/mm/compaction.c b/mm/compaction.c
index 7c607479de4a..d108974d0867 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1879,9 +1879,7 @@ int sysctl_compaction_handler(struct ctl_table *table,
int write,
int sysctl_extfrag_handler(struct ctl_table *table, int write,
void __user *buffer, size_t *length, loff_t *ppos)
{
- proc_dointvec_minmax(table, write, buffer, length, ppos);
-
- return 0;
+ return proc_dointvec_minmax(table, write, buffer, length, ppos);
}
#if defined(CONFIG_SYSFS) && defined(CONFIG_NUMA)
--
2.17.1
[PATCH] mm: compaction.c: Propagate return value upstream
In sysctl_extfrag_handler(), proc_dointvec_minmax() can return an
error. The fix propagates the error upstream in case of failure.
Signed-off-by: Aditya Pakki
---
mm/compaction.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/compaction.c b/mm/compaction.c
index 7c607479de4a..5703b4051796 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -1879,9 +1879,8 @@ int sysctl_compaction_handler(struct ctl_table *table,
int write,
int sysctl_extfrag_handler(struct ctl_table *table, int write,
void __user *buffer, size_t *length, loff_t *ppos)
{
+ return
proc_dointvec_minmax(table, write, buffer, length, ppos);
-
- return 0;
}
#if defined(CONFIG_SYSFS) && defined(CONFIG_NUMA)
--
2.17.1
[PATCH] infiniband: bnxt_re: qplib: Check the return value of send_message
In bnxt_qplib_map_tc2cos(), bnxt_qplib_rcfw_send_message() can return an error value. The fix returns the error from the latter function upstream. Signed-off-by: Aditya Pakki --- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c index 5216b5f844cc..adb8eae5193c 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c @@ -778,9 +778,8 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids) req.cos0 = cpu_to_le16(cids[0]); req.cos1 = cpu_to_le16(cids[1]); - bnxt_qplib_rcfw_send_message(rcfw, (void *), (void *), NULL, -0); - return 0; + return bnxt_qplib_rcfw_send_message(rcfw, (void *), (void *), + NULL, 0); } int bnxt_qplib_get_roce_stats(struct bnxt_qplib_rcfw *rcfw, -- 2.17.1
[PATCH] hmm: Warn on devres_release failure
devres_release can return -ENOENT if the device is not freed. The fix
throws a warning consistent with other invocations.
Signed-off-by: Aditya Pakki
---
mm/hmm.c | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/hmm.c b/mm/hmm.c
index 90c34f3d1243..b06e3f092fbf 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -1183,8 +1183,12 @@ static int hmm_devmem_match(struct device *dev, void
*data, void *match_data)
static void hmm_devmem_pages_remove(struct hmm_devmem *devmem)
{
- devres_release(devmem->device, _devmem_release,
- _devmem_match, devmem->resource);
+ int rc;
+
+ rc = devres_release(devmem->device, _devmem_release,
+ _devmem_match, devmem->resource);
+ if (rc)
+ WARN_ON(rc);
}
/*
--
2.17.1
[PATCH] net: phy: phy: check return value of bus write
phy_mii_ioctl() could fail when writing to the bus via
mdiobus_write(). The fix adds a check and returns an error in case
of failure.
Signed-off-by: Aditya Pakki
---
drivers/net/phy/phy.c | 7 +--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1d73ac3309ce..1fbdaa96b36e 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -397,6 +397,7 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq
*ifr, int cmd)
struct mii_ioctl_data *mii_data = if_mii(ifr);
u16 val = mii_data->val_in;
bool change_autoneg = false;
+ int rc;
switch (cmd) {
case SIOCGMIIPHY:
@@ -443,8 +444,10 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq
*ifr, int cmd)
}
}
- mdiobus_write(phydev->mdio.bus, mii_data->phy_id,
- mii_data->reg_num, val);
+ rc = mdiobus_write(phydev->mdio.bus, mii_data->phy_id,
+ mii_data->reg_num, val);
+ if (rc)
+ return rc;
if (mii_data->phy_id == phydev->mdio.addr &&
mii_data->reg_num == MII_BMCR &&
--
2.17.1
[PATCH] net:phy: Add a return value check on bus write
xgmiitorgmii_read_status() could fail when writing to the bus via mdiobus_write(). The fix adds a check and returns an error in case of failure. Signed-off-by: Aditya Pakki --- drivers/net/phy/xilinx_gmii2rgmii.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c index 74a8782313cf..926879d43373 100644 --- a/drivers/net/phy/xilinx_gmii2rgmii.c +++ b/drivers/net/phy/xilinx_gmii2rgmii.c @@ -58,7 +58,9 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev) else val |= BMCR_SPEED10; - mdiobus_write(bus, addr, XILINX_GMII2RGMII_REG, val); + err = mdiobus_write(bus, addr, XILINX_GMII2RGMII_REG, val); + if (err) + return err; return 0; } -- 2.17.1
[PATCH] char: hw_random: Fix missing check during driver release
devres_release can return -ENOENT if the device is not freed. The fix
throws a warning consistent with other invocations.
Signed-off-by: Aditya Pakki
---
drivers/char/hw_random/core.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 95be7228f327..582d983fa93f 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -578,7 +578,11 @@ EXPORT_SYMBOL_GPL(devm_hwrng_register);
void devm_hwrng_unregister(struct device *dev, struct hwrng *rng)
{
- devres_release(dev, devm_hwrng_release, devm_hwrng_match, rng);
+ int rc;
+
+ rc = devres_release(dev, devm_hwrng_release, devm_hwrng_match, rng);
+ if (rc)
+ WARN_ON(rc);
}
EXPORT_SYMBOL_GPL(devm_hwrng_unregister);
--
2.17.1
[PATCH] platform: x86: Add check for led_classdev_register
In function alienware_zone_init, the function led_classdev_register
can return an error on failure. The fix checks the error and frees
the allocated resources.
Signed-off-by: Aditya Pakki
---
drivers/platform/x86/alienware-wmi.c | 13 -
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/alienware-wmi.c
b/drivers/platform/x86/alienware-wmi.c
index f10af5c383c5..63ab6a2eb613 100644
--- a/drivers/platform/x86/alienware-wmi.c
+++ b/drivers/platform/x86/alienware-wmi.c
@@ -441,6 +441,7 @@ static int alienware_zone_init(struct platform_device *dev)
u8 zone;
char buffer[10];
char *name;
+ int ret;
if (interface == WMAX) {
lighting_control_state = WMAX_RUNNING;
@@ -492,7 +493,17 @@ static int alienware_zone_init(struct platform_device *dev)
zone_attrs[quirks->num_zones] = _attr_lighting_control_state.attr;
zone_attribute_group.attrs = zone_attrs;
- led_classdev_register(>dev, _led);
+ ret = led_classdev_register(>dev, _led);
+ if (ret < 0) {
+ if (zone_dev_attrs) {
+ for (zone = 0; zone < quirks->num_zones; zone++)
+ kfree(zone_dev_attrs[zone].attr.name);
+ }
+ kfree(zone_dev_attrs);
+ kfree(zone_data);
+ kfree(zone_attrs);
+ return ret;
+ }
return sysfs_create_group(>dev.kobj, _attribute_group);
}
--
2.17.1
[PATCH] hid: Add checks to fix of_led_classdev_register
In lenovo_probe_tpkbd(), the function of_led_classdev_register() could
return an error value that is unchecked. The fix adds these checks.
Signed-off-by: Aditya Pakki
---
drivers/hid/hid-lenovo.c | 10 --
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 643b6eb54442..eacc76d2ab96 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -743,7 +743,9 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
data_pointer->led_mute.brightness_get = lenovo_led_brightness_get_tpkbd;
data_pointer->led_mute.brightness_set = lenovo_led_brightness_set_tpkbd;
data_pointer->led_mute.dev = dev;
- led_classdev_register(dev, _pointer->led_mute);
+ ret = led_classdev_register(dev, _pointer->led_mute);
+ if (ret < 0)
+ goto err;
data_pointer->led_micmute.name = name_micmute;
data_pointer->led_micmute.brightness_get =
@@ -751,7 +753,11 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev)
data_pointer->led_micmute.brightness_set =
lenovo_led_brightness_set_tpkbd;
data_pointer->led_micmute.dev = dev;
- led_classdev_register(dev, _pointer->led_micmute);
+ ret = led_classdev_register(dev, _pointer->led_micmute);
+ if (ret < 0) {
+ led_classdev_unregister(_pointer->led_mute);
+ goto err;
+ }
lenovo_features_set_tpkbd(hdev);
--
2.17.1
[PATCH] net: chelsio: Add a missing check on cudg_get_buffer
cudbg_collect_hw_sched() could fail when the function cudg_get_buffer() returns an error. The fix adds a check to the latter function returning error on failure Signed-off-by: Aditya Pakki --- drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c index 7c49681407ad..127b1f624413 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c @@ -1229,6 +1229,10 @@ int cudbg_collect_hw_sched(struct cudbg_init *pdbg_init, rc = cudbg_get_buff(pdbg_init, dbg_buff, sizeof(struct cudbg_hw_sched), _buff); + + if (rc) + return rc; + hw_sched_buff = (struct cudbg_hw_sched *)temp_buff.data; hw_sched_buff->map = t4_read_reg(padap, TP_TX_MOD_QUEUE_REQ_MAP_A); hw_sched_buff->mode = TIMERMODE_G(t4_read_reg(padap, TP_MOD_CONFIG_A)); -- 2.17.1
[PATCH] clk: Fix a missing check on regmap_bulk_read
Currently, vc5_pll_recalc_rate() may produce incorrect output when regmap_bulk_read() fails. The fix checks the return value of the latter function and returns 0 in case of failure. Signed-off-by: Aditya Pakki --- drivers/clk/clk-versaclock5.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c index decffb3826ec..cd76a893c594 100644 --- a/drivers/clk/clk-versaclock5.c +++ b/drivers/clk/clk-versaclock5.c @@ -413,7 +413,8 @@ static unsigned long vc5_pll_recalc_rate(struct clk_hw *hw, u32 div_int, div_frc; u8 fb[5]; - regmap_bulk_read(vc5->regmap, VC5_FEEDBACK_INT_DIV, fb, 5); + if (regmap_bulk_read(vc5->regmap, VC5_FEEDBACK_INT_DIV, fb, 5)) + return 0; div_int = (fb[0] << 4) | (fb[1] >> 4); div_frc = (fb[2] << 16) | (fb[3] << 8) | fb[4]; -- 2.17.1
[PATCH] input/touchscreen: Fix a missing check on regmap_bulk_read
regmap_bulk_read() can return a non zero value on failure. The fix
checks if the function call succeeded before calling mod_timer.
Signed-off-by: Aditya Pakki
---
drivers/input/touchscreen/ad7879.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/input/touchscreen/ad7879.c
b/drivers/input/touchscreen/ad7879.c
index 6bad23ee47a1..735cb4c0d913 100644
--- a/drivers/input/touchscreen/ad7879.c
+++ b/drivers/input/touchscreen/ad7879.c
@@ -247,11 +247,12 @@ static void ad7879_timer(struct timer_list *t)
static irqreturn_t ad7879_irq(int irq, void *handle)
{
struct ad7879 *ts = handle;
+ int ret;
- regmap_bulk_read(ts->regmap, AD7879_REG_XPLUS,
-ts->conversion_data, AD7879_NR_SENSE);
+ ret = regmap_bulk_read(ts->regmap, AD7879_REG_XPLUS,
+ ts->conversion_data, AD7879_NR_SENSE);
- if (!ad7879_report(ts))
+ if (!ret && !ad7879_report(ts))
mod_timer(>timer, jiffies + TS_PEN_UP_TIMEOUT);
return IRQ_HANDLED;
--
2.17.1
[PATCH] infiniband/qedr: Potential null ptr dereference of qp
idr_find() may fail and return a NULL pointer. The fix checks the return value of the function and returns an error in case of NULL. Signed-off-by: Aditya Pakki --- drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c index 505fa3648762..93b16237b767 100644 --- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c +++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c @@ -492,6 +492,8 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) int i; qp = idr_find(>qpidr.idr, conn_param->qpn); + if (unlikely(!qp)) + return -EINVAL; laddr = (struct sockaddr_in *)_id->m_local_addr; raddr = (struct sockaddr_in *)_id->m_remote_addr; -- 2.17.1
[PATCH] batman-adv/main: Fix check on return value of rtnl_link_register
rtnl_link_register() may fail and can impact registering the device.
The fix checks the return value and pushes the error upstream.
Signed-off-by: Aditya Pakki
---
net/batman-adv/main.c | 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 69c0d85bceb3..e0007f242823 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -109,7 +109,10 @@ static int __init batadv_init(void)
batadv_debugfs_init();
register_netdevice_notifier(_hard_if_notifier);
- rtnl_link_register(_link_ops);
+ ret = rtnl_link_register(_link_ops);
+ if (ret < 0)
+ return ret;
+
batadv_netlink_register();
pr_info("B.A.T.M.A.N. advanced %s (compatibility version %i) loaded\n",
--
2.17.1
[PATCH] dma/mv_xor: Fix a missing check in mv_xor_channel_add
dma_async_device_register() may fail and return an error. The capabilities checked in mv_xor_channel_add() are not complete. The fix handles the error by freeing the resources. Signed-off-by: Aditya Pakki --- drivers/dma/mv_xor.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c index 7f595355fb79..e733c5eeaabc 100644 --- a/drivers/dma/mv_xor.c +++ b/drivers/dma/mv_xor.c @@ -1153,7 +1153,10 @@ mv_xor_channel_add(struct mv_xor_device *xordev, dma_has_cap(DMA_MEMCPY, dma_dev->cap_mask) ? "cpy " : "", dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask) ? "intr " : ""); - dma_async_device_register(dma_dev); + ret = dma_async_device_register(dma_dev); + if (ret) + goto err_free_irq; + return mv_chan; err_free_irq: -- 2.17.1
[PATCH] misc/ics932s401: Add a missing check to i2c_smbus_read_word_data
ics932s401_update_device may fail reading in i2c_smbus_read_word_data
due to error in i2c_smbus_xfer. The fix checks the status and defaults
the register to 0.
Signed-off-by: Aditya Pakki
---
drivers/misc/ics932s401.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 81a0541ef3ac..294fb2f66bfe 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -146,6 +146,8 @@ static struct ics932s401_data
*ics932s401_update_device(struct device *dev)
*/
for (i = 0; i < NUM_MIRRORED_REGS; i++) {
temp = i2c_smbus_read_word_data(client, regs_to_copy[i]);
+ if (temp < 0)
+ data->regs[regs_to_copy[i]] = 0;
data->regs[regs_to_copy[i]] = temp >> 8;
}
--
2.17.1
[PATCH] slimbus: Add a check on the return value of platform_device_add
In of_qcom_slim_ngd_register, the function platform_device_add() may fail. The fix returns the error value upstream in case of failure. Signed-off-by: Aditya Pakki --- drivers/slimbus/qcom-ngd-ctrl.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c index 1382a8df6c75..a2dffb2b4c88 100644 --- a/drivers/slimbus/qcom-ngd-ctrl.c +++ b/drivers/slimbus/qcom-ngd-ctrl.c @@ -1329,6 +1329,7 @@ static int of_qcom_slim_ngd_register(struct device *parent, struct qcom_slim_ngd *ngd; struct device_node *node; u32 id; + int ret; data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data; @@ -1348,7 +1349,10 @@ static int of_qcom_slim_ngd_register(struct device *parent, ctrl->ngd = ngd; platform_set_drvdata(ngd->pdev, ctrl); - platform_device_add(ngd->pdev); + ret = platform_device_add(ngd->pdev); + if (ret) + return ret; + ngd->base = ctrl->base + ngd->id * data->offset + (ngd->id - 1) * data->size; ctrl->ngd = ngd; -- 2.17.1
[PATCH] x86/intel-mid: Add pr_warn when platform_device_add() fails
platform_device_add() may fail in intel_scu_devices_create and
sfi_handle_ipc_dev. The fix checks for the return value in these cases
and displays the failed device.
Signed-off-by: Aditya Pakki
---
arch/x86/platform/intel-mid/sfi.c | 16
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/arch/x86/platform/intel-mid/sfi.c
b/arch/x86/platform/intel-mid/sfi.c
index 7be1e1fe9ae3..e69511bafec5 100644
--- a/arch/x86/platform/intel-mid/sfi.c
+++ b/arch/x86/platform/intel-mid/sfi.c
@@ -278,9 +278,13 @@ static void __init intel_scu_i2c_device_register(int bus,
void intel_scu_devices_create(void)
{
int i;
+ int ret;
- for (i = 0; i < ipc_next_dev; i++)
- platform_device_add(ipc_devs[i]);
+ for (i = 0; i < ipc_next_dev; i++) {
+ ret = platform_device_add(ipc_devs[i]);
+ if (ret)
+ pr_warn("can't add device %s\n", ipc_devs[i]);
+ }
for (i = 0; i < spi_next_dev; i++)
spi_register_board_info(spi_devs[i], 1);
@@ -330,6 +334,7 @@ static void __init sfi_handle_ipc_dev(struct
sfi_device_table_entry *pentry,
{
struct platform_device *pdev;
void *pdata = NULL;
+ int ret;
pr_debug("IPC bus, name = %16.16s, irq = 0x%2x\n",
pentry->name, pentry->irq);
@@ -360,8 +365,11 @@ static void __init sfi_handle_ipc_dev(struct
sfi_device_table_entry *pentry,
pdev->dev.platform_data = pdata;
if (dev->delay)
intel_scu_ipc_device_register(pdev);
- else
- platform_device_add(pdev);
+ else {
+ ret = platform_device_add(pdev);
+ if (ret)
+ pr_warn("can't add device %s\n", pdev);
+ }
}
static void __init sfi_handle_spi_dev(struct sfi_device_table_entry *pentry,
--
2.17.1
[PATCH] ipv6/route: Add a missing check on proc_dointvec
While flushing the cache via ipv6_sysctl_rtcache_flush(), the call
to proc_dointvec() may fail. The fix adds a check that returns the
error, on failure.
Signed-off-by: Aditya Pakki
---
net/ipv6/route.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 059f0531f7c1..5ccdaa27ec53 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5053,12 +5053,16 @@ int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl,
int write,
{
struct net *net;
int delay;
+ int ret;
if (!write)
return -EINVAL;
net = (struct net *)ctl->extra1;
delay = net->ipv6.sysctl.flush_delay;
- proc_dointvec(ctl, write, buffer, lenp, ppos);
+ ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
+
fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
return 0;
}
--
2.17.1
[PATCH] rts5208: Add a check on the status of ms_send_cmd
In mspro_stop_seq_mode(), ms_send_cmd() may fail. The patch attempts to detect a failure before flushing the registers via rtsx_write_register. Signed-off-by: Aditya Pakki --- drivers/staging/rts5208/ms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rts5208/ms.c b/drivers/staging/rts5208/ms.c index f53adf15c685..04b588b8b376 100644 --- a/drivers/staging/rts5208/ms.c +++ b/drivers/staging/rts5208/ms.c @@ -2586,7 +2586,9 @@ void mspro_stop_seq_mode(struct rtsx_chip *chip) ms_card->seq_mode = 0; ms_card->total_sec_cnt = 0; - ms_send_cmd(chip, PRO_STOP, WAIT_INT); + retval = ms_send_cmd(chip, PRO_STOP, WAIT_INT); + if (retval != STATUS_SUCCESS) + return; rtsx_write_register(chip, RBCTL, RB_FLUSH, RB_FLUSH); } -- 2.17.1
[PATCH] media/lgdt3306a: Add a missing return value check.
In lgdt3306a.c, lgdt3306a_read_signal_strength() can fail while reading the registers via lgdt3306a_read_reg(). The function can return an error from i2c_transfer(). The fix checks the return value for this failure. Signed-off-by: Aditya Pakki --- drivers/media/dvb-frontends/lgdt3306a.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index 0e1f5daaf20c..b79f652d05e1 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -1685,7 +1685,10 @@ static int lgdt3306a_read_signal_strength(struct dvb_frontend *fe, case QAM_256: case QAM_AUTO: /* need to know actual modulation to set proper SNR baseline */ - lgdt3306a_read_reg(state, 0x00a6, ); + ret = lgdt3306a_read_reg(state, 0x00a6, ); + if (lg_chkerr(ret)) + goto fail; + if(val & 0x04) ref_snr = 2800; /* QAM-256 28dB */ else -- 2.17.1
[PATCH] net/net_namespace: Check the return value of register_pernet_subsys()
In net_ns_init(), register_pernet_subsys() could fail while registering
network namespace subsystems. The fix checks the return value and
sends a panic() on failure.
Signed-off-by: Aditya Pakki
---
net/core/net_namespace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index fefe72774aeb..af8849a7a9c3 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -917,7 +917,8 @@ static int __init net_ns_init(void)
init_net_initialized = true;
up_write(_ops_rwsem);
- register_pernet_subsys(_ns_ops);
+ if (register_pernet_subsys(_ns_ops))
+ panic("Could not register network namespace subsystems");
rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
RTNL_FLAG_DOIT_UNLOCKED);
--
2.17.1
[PATCH] net/netlink_compat: Fix a missing check of nla_parse_nested
In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return an error. To be consistent with other invocations of the function call, on error, the fix passes the return value upstream. Signed-off-by: Aditya Pakki --- net/tipc/netlink_compat.c | 7 +-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index 6376467e78f8..21f6ccc89401 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -951,8 +951,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg, u32 node; struct nlattr *con[TIPC_NLA_CON_MAX + 1]; - nla_parse_nested(con, TIPC_NLA_CON_MAX, -sock[TIPC_NLA_SOCK_CON], NULL, NULL); + err = nla_parse_nested(con, TIPC_NLA_CON_MAX, + sock[TIPC_NLA_SOCK_CON], NULL, NULL); + + if (err) + return err; node = nla_get_u32(con[TIPC_NLA_CON_NODE]); tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>", -- 2.17.1
[PATCH] rtl8723bs/ioctl_linux: Add a security check to copy_from_user()
Currently, the return value of copy_from_user is not checked.
extra is assigned to u32wps_start irrespective of these failures.
Signed-off-by: Aditya Pakki
---
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
index b8631baf128d..9992caa8c839 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -2577,14 +2577,19 @@ static int rtw_wps_start(struct net_device *dev,
struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
struct iw_point *pdata = >data;
u32 u32wps_start = 0;
-unsigned int uintRet = 0;
if ((true == padapter->bDriverStopped) ||(true
==padapter->bSurpriseRemoved) || (NULL == pdata)) {
ret = -EINVAL;
goto exit;
}
- uintRet = copy_from_user((void*)_start, pdata->pointer, 4);
+ ret = copy_from_user((void *)_start, pdata->pointer, 4);
+
+ if (ret) {
+ ret = -EINVAL;
+ goto exit;
+ }
+
if (u32wps_start == 0)
u32wps_start = *extra;
--
2.17.1
