| Age | Commit message (Collapse) | Author |
|---|
|
Replace goto-based error handling with direct returns and
remove the temporary res variable.
No functional change.
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
Link: https://patch.msgid.link/20260707112503.612-2-dennylin0707@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
and rtw_get_wps_attr()
Three IE/attribute parsing functions have missing bounds checks.
rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer
without verifying that the header bytes (tag + length) are within the
remaining buffer before reading them. Additionally, rtw_get_sec_ie()
compares the 4-byte WPA OUI at cnt+2 without checking that at least
6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at
cnt+6 without checking that at least 10 bytes remain.
rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at
entry, before verifying that wps_ielen is large enough to contain
the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside
the attribute loop, get_unaligned_be16() is called on attr_ptr and
attr_ptr+2 without checking that 4 bytes remain in the buffer.
Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()
and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum
IE length requirement, add a wps_ielen < 6 early return in
rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-8-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The loop in is_ap_in_tkip() iterates over IEs without verifying that
enough bytes remain before dereferencing the IE header or its payload:
- pIE->element_id and pIE->length are read without checking that
i + sizeof(*pIE) <= ie_length, so a truncated IE at the end of the
buffer causes an OOB read.
- For WLAN_EID_VENDOR_SPECIFIC the code compares pIE->data + 12,
which requires pIE->length >= 16. For WLAN_EID_RSN it compares
pIE->data + 8, requiring pIE->length >= 12. Neither requirement
is checked.
Add the missing IE header and payload bounds checks and guard each
data access with an explicit pIE->length minimum, matching the
pattern established in update_beacon_info().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-7-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260522004531.1038924-6-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
HT_caps_handler() iterates pIE->length bytes and writes into
HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct
HT_caps_element). Because pIE->length is a raw u8 from an over-the-air
802.11 AssocResponse frame and is never validated, a malicious AP can
set it up to 255, causing up to 229 bytes of out-of-bounds writes into
adjacent fields of struct mlme_ext_info.
Truncate the iteration count to the size of HT_caps.u.HT_cap using
umin() so that data from a longer-than-expected IE is silently ignored
rather than written out of bounds, preserving interoperability with APs
that pad the element. An early return on oversized IEs was considered
but rejected: it would bypass the pmlmeinfo->HT_caps_enable = 1
assignment that precedes the loop, silently disabling HT mode for APs
that append extra bytes to the HT Capabilities IE.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Link: https://patch.msgid.link/20260522004531.1038924-5-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-4-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
join_cmd_hdl()
Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the
association request. If the stored IE data ends with only an
element_id byte and no length byte, pIE->length is read one byte
past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has
the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The IE parsing loop in update_beacon_info() advances by
(pIE->length + 2) each iteration but only guards on i < len.
When a malicious AP sends a Beacon whose last IE has only one byte
remaining in the frame (the element_id byte lands at len-1), the loop
reads pIE->length from one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond len, passing a truncated IE
to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past len.
Also replace i += (pIE->length + 2) with i += sizeof(*pIE) + pIE->length
for consistency with the sizeof(*pIE) guards added above.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
OnAuth() has two bugs in the shared-key authentication path.
When the Privacy bit is set, rtw_wep_decrypt() is called without
verifying that the frame is long enough to contain a valid WEP IV and
ICV. Inside rtw_wep_decrypt(), length is computed as:
length = len - WLAN_HDR_A3_LEN - iv_len
and then passed as (length - 4) to crc32_le(). If len is less than
WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative
and, after the implicit cast to size_t, causes crc32_le() to read far
beyond the frame buffer. Add a minimum length check before accessing
the IV field and calling the decryption path.
When processing a seq=3 response, rtw_get_ie() stores the Challenge
Text IE length in ie_len, but the subsequent memcmp() always reads 128
bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of
exactly 128 bytes; reject any IE whose length field differs, matching
the check already applied to OnAuthClient().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004605.1039209-1-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
tsi148_probe() allocates a location monitor resource and links it into
tsi148_bridge->lm_resources. The probe error path frees this list, but
tsi148_remove() only frees the dma, slave and master resource lists, so
the location monitor resource is leaked on device unbind or module
unload.
Free the lm_resources list in tsi148_remove() as well, before
tsi148_bridge is freed.
Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Cc: stable <stable@kernel.org>
Cc: Martyn Welch <martyn@welchs.me.uk>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704065817.403111-2-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
fake_init() allocates a location monitor resource and links it into
fake_bridge->lm_resources. The init error path frees this list, but
fake_exit() only frees the slave and master resource lists. Loading
and unloading the module therefore triggers a kmemleak warning:
unreferenced object 0xffff8b8b82aebe40 (size 64):
comm "init", pid 1, jiffies 4294894572
backtrace (crc c1e013ef):
kmemleak_alloc+0x4e/0x90
__kmalloc_cache_noprof+0x338/0x430
0xffffffffc0602246
do_one_initcall+0x4f/0x320
do_init_module+0x68/0x270
load_module+0x2a3b/0x2d90
Free the lm_resources list in fake_exit() as well, before fake_bridge
is freed.
Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver")
Cc: stable <stable@kernel.org>
Cc: Martyn Welch <martyn@welchs.me.uk>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704065817.403111-1-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy
'count' bytes into/out of the fixed-size kern_buf (size_buf ==
PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without
bounding *ppos + count against size_buf.
vme_user_write()/vme_user_read() only clamp count to the VME window size
(image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the
user-supplied slave.size -- validated against the VME address space (up
to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window
exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.
Clamp count against size_buf in both helpers, with an early return when
*ppos is already at/after the buffer end. *ppos is >= 0 here (the caller
rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors
the existing clamp in the MASTER-path helpers resource_to_user() /
resource_from_user(), and matches the read()/write() convention of a
short transfer at end-of-buffer.
Found by static analysis (CodeQL taint tracking + CBMC bounded model
checking) and confirmed dynamically under KASAN with the vme_fake bridge:
BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80
Write of size 262144 at addr ffff888004100000 by task trigger/68
_copy_from_user+0x2d/0x80
vme_user_write+0x13e/0x240 [vme_user]
vfs_write+0x1b8/0x7a0
ksys_write+0xb8/0x150
Fixes: f00a86d98a1e ("Staging: vme: add VME userspace driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Michael Tautschnig <tautschn@amazon.com>
Link: https://patch.msgid.link/20260618114709.72499-1-tautschn@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Commit bc4df274dca6 ("staging: rtl8723bs: update _rtw_pktfile_read() to
return error codes") changed _rtw_pktfile_read() to fail when the caller
asks for more bytes than remain in the packet:
if (rtw_remainder_len(pfile) < rlen)
return -EINVAL;
That breaks the assumption made by the data TX path. In
rtw_xmitframe_coalesce() (core/rtw_xmit.c) the per-fragment copy is
issued with the full fragment length, mpdu_len, which is derived from
pxmitpriv->frag_len (~2300 bytes), and the code relies on the historical
behaviour of copying only what is left and returning the number of bytes
actually copied:
mem_sz = _rtw_pktfile_read(&pktfile, pframe, mpdu_len);
if (mem_sz < 0)
return mem_sz;
So for every outbound packet smaller than the fragmentation threshold -
i.e. essentially all normal traffic, including the EAPOL frames of the
WPA 4-way handshake and DHCP - rlen is larger than the bytes remaining,
_rtw_pktfile_read() returns -EINVAL, rtw_xmitframe_coalesce() aborts, and
the frame is dropped before it is queued to the hardware. The driver
floods the log with:
rtl8723bs ...: xmit_xmitframes: coalesce failed with error -22
Management frames (authentication/association) use a different path and
still go out, so the interface scans and associates, but no data frame is
ever transmitted. The 4-way handshake therefore never completes and
wpa_supplicant misreports it as:
WPA: 4-Way Handshake failed - pre-shared key may be incorrect
AP mode is unaffected. The net effect is that the chip is unusable in
station mode on any kernel carrying the offending commit.
This was confirmed with a wpa_supplicant -dd trace on an RTL8723BS SDIO
adapter (Bay Trail): message 1/4 is received and the PTK is derived, but
each "Sending EAPOL-Key 2/4" coincides 1:1 with a "coalesce failed with
error -22", so message 2/4 never reaches the AP, which keeps retrying
message 1/4 until the handshake times out.
Restore the original semantics: clamp the requested length to the bytes
remaining in the packet and return that length. The skb_copy_bits()
error path is kept, so genuine copy failures are still propagated.
Fixes: bc4df274dca6 ("staging: rtl8723bs: update _rtw_pktfile_read() to return error codes")
Cc: stable <stable@kernel.org>
Tested-by: Christopher Mackle <christophermackle01@gmail.com>
Signed-off-by: Christopher Mackle <christophermackle01@gmail.com>
Link: https://patch.msgid.link/20260620013916.7148-1-christophermackle01@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Using magic numbers is error prone. The address
0x948 already has a define, rS0S1_PathSwitch,
in Hal8192CPhyReg.h. Replace the occurrences of
the magic number 0x948 with the rS0S1_PathSwitch
define for more clarity and readability.
No functional change intended.
Signed-off-by: Panagiotis Petrakopoulos <npetrakopoulos2003@gmail.com>
Link: https://patch.msgid.link/20260705153243.32484-1-npetrakopoulos2003@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Add braces so all blocks in an if else statement are consistent as per
kernel coding style.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-7-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove unnecessary parentheses around address-of structure members.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-6-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove commented-out old code to help readability.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-5-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Align parameters in function calls and definitions with the
opening parentheses to conform to the coding style.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-4-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Add spaces around binary operators to improve readability.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-3-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove commented-out dead code block for readability.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260630163316.1128319-2-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The inner variable ie in update_bcn_erpinfo_ie() shadows an outer local
variable of the same name. This triggers a -Wshadow warning.
Rename the inner variable to erp_ie to remove the warning
and make the code less ambiguous.
No functional change.
Signed-off-by: Aditya Tipre <tipreaditya@gmail.com>
Link: https://patch.msgid.link/20260625151606.96229-1-tipreaditya@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Move the logical operator '&&' to the previous line in os_intfs.c
to conform to the Linux kernel coding style guidelines.
This fixes the checkpatch.pl warning:
CHECK: Logical continuations should be on the previous line
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260623100535.5752-2-serhatkumral1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove multiple blank lines in os_intfs.c to conform to the
Linux kernel coding style guidelines.
This fixes the checkpatch.pl warnings:
CHECK: Please don't use multiple blank lines
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Link: https://patch.msgid.link/20260623100535.5752-1-serhatkumral1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The function only supports NL80211_BAND_2GHZ and falls through to
exit for any other band. Replace the n_channels and n_bitrates local
variables with the compile-time constants RTW_2G_CHANNELS_NUM and
RTW_G_RATES_NUM directly.
Use simple addition in kzalloc() instead of chained size_add() calls,
since the sizes are derived from compile-time constants and cannot
overflow. Replace the intermediate alloc_sz variable accordingly.
Remove the redundant second band check before the init calls, as
the early exit at the top of the function guarantees that only the
2GHz case can reach that point.
No functional change intended.
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260622160947.7970-1-serhatkumral1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Replace bare use of 'uint' with 'unsigned int' for the status variable
in rtw_drv_init(). The module_param() uses of 'uint' are intentional
and left unchanged. This fixes the following checkpatch.pl warning:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Link: https://patch.msgid.link/20260622064129.10261-4-mokshpanicker.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Replace bare use of 'uint' with 'unsigned int' in rtw_remainder_len()
function definition and its declaration in xmit_osdep.h. This fixes
the following checkpatch.pl warning:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Link: https://patch.msgid.link/20260622064129.10261-3-mokshpanicker.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Replace bare use of 'uint' with 'unsigned int' in function parameters
and local variables in ioctl_cfg80211.c and its corresponding header
ioctl_cfg80211.h. This fixes the following checkpatch.pl warning:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Link: https://patch.msgid.link/20260622064129.10261-2-mokshpanicker.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
After removing the loop from the phy_RF6052_Config_ParaFile() function,
the value of this variable can no longer be changed, allowing all
switch-case statements to be known in advance, since it stores the value
0 (which is 'RF_PATH_A', defined in enum rf_path).
Therefore, remove it and the associated dead code and access 'RF_PATH_A'
directly.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260621161611.111461-3-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
This variable is assigned the value 1, after which it is used as a loop
delimiter. Since it always stores 1, only one loop iteration is
performed. We can remove the 'NumTotalRFPath' field and remove the loop
by calling its body directly to simplify the code.
Signed-off-by: Nikolay Kulikov <nikolayof23@gmail.com>
Link: https://patch.msgid.link/20260621161611.111461-2-nikolayof23@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Align continuation lines which weren't properly aligned.
Signed-off-by: Dalvin-Ehinoma Noah Aiguobas <fliegbert2@gmail.com>
Link: https://patch.msgid.link/ajbQ4m5HAaL2yflQ@koolguy
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Rename the CamelCase field ScanType of struct rt_channel_info, as
well as the relevant local variables, to scan_type to conform to
the Linux kernel coding style guidelines.
This also fixes several checkpatch.pl warnings:
CHECK: Avoid CamelCase: <ScanType>
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Link: https://patch.msgid.link/20260616000117.126504-2-serhatkumral1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Rename the CamelCase field ChannelNum of struct rt_channel_info to
channel_num to conform to the Linux kernel coding style guidelines.
This also fixes several checkpatch.pl warnings:
CHECK: Avoid CamelCase: <ChannelNum>
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
Link: https://patch.msgid.link/20260616000117.126504-1-serhatkumral1@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Single statement blocks do not need braces
if and else blocks should have consistent bracing
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260619191021.2205395-1-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
In rtw_drv_init(), if rtw_drv_register_netdev() succeeds but
sdio_alloc_irq() fails, the error path jumps to free_if1 and calls
rtw_sdio_if1_deinit(). However, rtw_sdio_if1_deinit() calls
rtw_free_netdev() without a preceding unregister_netdev(), freeing a
still-registered netdev but leaving stale sysfs entries behind.
Signed-off-by: Devansh Soni <devanshsoni874@gmail.com>
Link: https://patch.msgid.link/20260619125724.12458-1-devanshsoni874@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Single statement if block does not need braces.
Signed-off-by: Alonso Garrigues <agarrigues@riseup.net>
Link: https://patch.msgid.link/20260619105327.1877129-1-agarrigues@riseup.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
The original code allocated extra memory and manually aligned the
rsp_buf pointer to a 4-byte boundary, however kzalloc() guarantees a
minimum of 8-byte alignment so this was unnecessary.
Also, because the pointer was shifted, the original pointer had to be
stored in rsp_allocated_buf just so it could be passed to kfree() later.
Remove the redundant alignment math, remove the extra 4 bytes of padding
from kzalloc() call, and assign memory directly to rsp_buf.
This allows us to remove the rsp_allocated_buf variable from cmd_priv
struct.
Suggested-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Devansh Soni <devanshsoni874@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260617123853.63022-1-devanshsoni874@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Fix various comment style issues in wlan_bssdef.h and rtw_mlme.h
to comply with kernel coding style:
- Use proper multi-line comment format with trailing */ on its
own line
- Remove extra spaces after /* in single-line comments
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260617064150.16078-3-subhrojyoti0609@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Enum members were missing tab indentation. Add proper tab
indent to align with kernel coding style.
No functional change.
Signed-off-by: Subhrojyoti Bala <subhrojyoti0609@gmail.com>
Link: https://patch.msgid.link/20260617064150.16078-2-subhrojyoti0609@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Add missing spaces around arithmetic and bitwise operators ('+', '-',
'&') in the rtl8723bs staging driver across multiple files. These were
flagged by checkpatch.pl with:
CHECK: spaces preferred around that 'X' (ctx:VxV)
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Link: https://patch.msgid.link/20260615082538.12007-1-mokshpanicker.7@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
option
Comments in the rtl8723bs driver contain references to
CONFIG_IOCTL_CFG80211, which does not exist in the kernel. Remove these
references.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260613231514.145336-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
A comment in the rtl8723bs driver contains a reference to
CONFIG_SDIO_HCI, which does not exist in the kernel. Remove it.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260613183055.10425-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-7-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-6-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-4-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-3-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-2-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Remove spaces before tabs in comments to match kernel coding style.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Link: https://patch.msgid.link/20260612102834.39935-1-qstrydom0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
CHAN_FMT and CHAN_ARG are defined but never used anywhere in
the driver. Most of their content is commented-out dead code.
Remove them.
This also fixes a checkpatch error:
ERROR: Macros with complex values should be enclosed in parentheses
Signed-off-by: Chen-Yu Yeh <chenyou910331@gmail.com>
Link: https://patch.msgid.link/20260611081644.1553264-1-chenyou910331@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
NDEV_ARG, FUNC_NDEV_FMT and FUNC_NDEV_ARG are defined but never
used anywhere in the driver. Remove them.
This also fixes a checkpatch error:
ERROR: Macros with complex values should be enclosed in parentheses
Signed-off-by: Chen-Yu Yeh <chenyou910331@gmail.com>
Link: https://patch.msgid.link/20260611074613.1550984-1-chenyou910331@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Comments in the rtl8723bs driver contain many references to
CONFIG_IEEE80211W, which does not exist in the kernel (though it does
exist in wpa_supplicant, where this code was likely also used). Remove
them.
Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260611014430.437534-1-enelsonmoore@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
