kernel/linux.git/drivers/net/wan/farsync.c, branch v4.4.171

farsync: fix off-by-one bug in fst_add_one

2016-04-20T06:42:03+00:00

[ Upstream commit e725a66c0202b5f36c2f9d59d26a65c53bbf21f7 ] gcc-6 finds an out of bounds access in the fst_add_one function when calculating the end of the mmio area: drivers/net/wan/farsync.c: In function 'fst_add_one': drivers/net/wan/farsync.c:418:53: error: index 2 denotes an offset greater than size of 'u8[2][8192] {aka unsigned char[2][8192]}' [-Werror=array-bounds] #define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X)) ^ include/linux/compiler-gcc.h:158:21: note: in definition of macro '__compiler_offsetof' __builtin_offsetof(a, b) ^ drivers/net/wan/farsync.c:418:37: note: in expansion of macro 'offsetof' #define BUF_OFFSET(X) (BFM_BASE + offsetof(struct buf_window, X)) ^~~~~~~~ drivers/net/wan/farsync.c:2519:36: note: in expansion of macro 'BUF_OFFSET' + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ^~~~~~~~~~ The warning is correct, but not critical because this appears to be a write-only variable that is set by each WAN driver but never accessed afterwards. I'm taking the minimal fix here, using the correct pointer by pointing 'mem_end' to the last byte inside of the register area as all other WAN drivers do, rather than the first byte outside of it. An alternative would be to just remove the mem_end member entirely. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

PCI: Remove DEFINE_PCI_DEVICE_TABLE macro use

2014-08-12T18:15:14+00:00

We should prefer `struct pci_device_id` over `DEFINE_PCI_DEVICE_TABLE` to meet kernel coding style guidelines. This issue was reported by checkpatch. A simplified version of the semantic patch that makes this change is as follows (http://coccinelle.lip6.fr/): // @@ identifier i; declarer name DEFINE_PCI_DEVICE_TABLE; initializer z; @@ - DEFINE_PCI_DEVICE_TABLE(i) + const struct pci_device_id i[] = z; // [bhelgaas: add semantic patch] Signed-off-by: Benoit Taine Signed-off-by: Bjorn Helgaas

farsync: fix invalid memory accesses in fst_add_one() and fst_init_card()

2014-07-11T20:34:48+00:00

There are several issues in fst_add_one() and fst_init_card(): - invalid pointer dereference at card->ports[card->nports - 1] if register_hdlc_device() fails for the first port in fst_init_card(); - fst_card_array overflow at fst_card_array[no_of_cards_added] because there is no checks for array overflow; - use after free because pointer to deallocated card is left in fst_card_array if something fails after fst_card_array[no_of_cards_added] = card; - several leaks on failure paths in fst_add_one(). The patch fixes all the issues and makes code more readable. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: David S. Miller

farsync: Fix confusion about DMA address and buffer offset types

2014-06-11T07:45:29+00:00

Use dma_addr_t for DMA address parameters and u32 for shared memory offset parameters. Do not assume that dma_addr_t is the same as unsigned long; it will not be in PAE configurations. Truncate DMA addresses to 32 bits when printing them. This is OK because the DMA mask for this device is 32-bit (per default). Also rename the DMA address parameters from 'skb' to 'dma'. Compile-tested only. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller

wan: Use usleep_range()

2014-06-03T00:01:33+00:00

Instead of using a jiffies hack we can use the standard api for delays. Signed-off-by: Manuel Schölling Signed-off-by: David S. Miller

farsync: fix info leak in ioctl

2013-10-11T21:50:59+00:00

The fst_get_iface() code fails to initialize the two padding bytes of struct sync_serial_settings after the ->loopback member. Add an explicit memset(0) before filling the structure to avoid the info leak. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller

wan: Remove unnecessary alloc/OOM messages

2013-02-04T18:22:34+00:00

alloc failures already get standardized OOM messages and a dump_stack. Hoist assigns from if tests. Signed-off-by: Joe Perches Signed-off-by: David S. Miller

farsync: remove __dev* attributes

2012-12-03T19:17:06+00:00

CONFIG_HOTPLUG is going away as an option. As result the __dev* markings will be going away. Remove use of __devinit, __devexit_p, __devinitdata, __devinitconst, and __devexit. Signed-off-by: Bill Pemberton Cc: Kevin Curtis Signed-off-by: Greg Kroah-Hartman

farsync: fix support for over 30 cards

2012-10-09T17:54:59+00:00

We're trying to fill a 64 bit bitmap but only the lower 30 shifts work because the shift wraps around. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller

drivers/net/wan/farsync.c: add missing iounmap

2012-04-18T02:31:59+00:00

Free card->mem in the error-handling code since it was successfully allocated just above. Signed-off-by: Julia Lawall Signed-off-by: David S. Miller