| Message ID | 20250414072058.2222-1-vulab@iscas.ac.cn (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | [RESEND] brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() | expand |
On 4/14/2025 9:20 AM, Wentao Liang wrote: > The function brcmf_usb_dl_writeimage() calls the function > brcmf_usb_dl_cmd() but dose not check its return value. The > 'state.state' and the 'state.bytes' are uninitialized if the > function brcmf_usb_dl_cmd() fails. It is dangerous to use > uninitialized variables in the conditions. > > Add error handling for brcmf_usb_dl_cmd() to jump to error > handling path if the brcmf_usb_dl_cmd() fails and the > 'state.state' and the 'state.bytes' are uninitialized. Agree. Have one request though... Just below the code you touched the USB bootloader state is checked: /* 2) Check we are in the Waiting state */ if (rdlstate != DL_WAITING) { - brcmf_err("Failed to DL_START\n"); + brcmf_err("Invalid DL state: %u\n", rdlstate); err = -EINVAL; goto fail; } Can you improve the error message as suggested. Regards, Arend > Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") > Cc: stable@vger.kernel.org # v3.4+ > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c index 50dddac8a2ab..1c97cd777225 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c @@ -901,7 +901,9 @@ brcmf_usb_dl_writeimage(struct brcmf_usbdev_info *devinfo, u8 *fw, int fwlen) } /* 1) Prepare USB boot loader for runtime image */ - brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); + err = brcmf_usb_dl_cmd(devinfo, DL_START, &state, sizeof(state)); + if (err) + goto fail; rdlstate = le32_to_cpu(state.state); rdlbytes = le32_to_cpu(state.bytes);
The function brcmf_usb_dl_writeimage() calls the function brcmf_usb_dl_cmd() but dose not check its return value. The 'state.state' and the 'state.bytes' are uninitialized if the function brcmf_usb_dl_cmd() fails. It is dangerous to use uninitialized variables in the conditions. Add error handling for brcmf_usb_dl_cmd() to jump to error handling path if the brcmf_usb_dl_cmd() fails and the 'state.state' and the 'state.bytes' are uninitialized. Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets") Cc: stable@vger.kernel.org # v3.4+ Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)