This is a note to let you know that I've just added the patch titled staging: r8188eu: delete rtw_wx_read/write32() to the 5.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: staging-r8188eu-delete-rtw_wx_read-write32.patch and it can be found in the queue-5.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 4d0cc9e0e53e9946d7b8dc58279c62dfa7a2191b Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Thu, 19 May 2022 08:17:20 +0300 Subject: staging: r8188eu: delete rtw_wx_read/write32() From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> commit 4d0cc9e0e53e9946d7b8dc58279c62dfa7a2191b upstream. These debugging tools let you call: status = usb_control_msg_recv/send(udev, 0, REALTEK_USB_VENQT_CMD_REQ, REALTEK_USB_VENQT_READ/WRITE, value, REALTEK_USB_VENQT_CMD_IDX, io_buf, size, RTW_USB_CONTROL_MSG_TIMEOUT, GFP_KERNEL); with a user controlled "value" in the 0-0xffff range. It's not a valid API. Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver") Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Link: https://lore.kernel.org/r/YoXS4OaD1oauPvmj@kili Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/staging/r8188eu/os_dep/ioctl_linux.c | 86 --------------------------- 1 file changed, 2 insertions(+), 84 deletions(-) --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -1888,88 +1888,6 @@ static int rtw_wx_get_nick(struct net_de return 0; } -static int rtw_wx_read32(struct net_device *dev, - struct iw_request_info *info, - union iwreq_data *wrqu, char *extra) -{ - struct adapter *padapter; - struct iw_point *p; - u16 len; - u32 addr; - u32 data32; - u32 bytes; - u8 *ptmp; - int ret; - - padapter = (struct adapter *)rtw_netdev_priv(dev); - p = &wrqu->data; - len = p->length; - ptmp = memdup_user(p->pointer, len); - if (IS_ERR(ptmp)) - return PTR_ERR(ptmp); - - bytes = 0; - addr = 0; - sscanf(ptmp, "%d,%x", &bytes, &addr); - - switch (bytes) { - case 1: - data32 = rtw_read8(padapter, addr); - sprintf(extra, "0x%02X", data32); - break; - case 2: - data32 = rtw_read16(padapter, addr); - sprintf(extra, "0x%04X", data32); - break; - case 4: - data32 = rtw_read32(padapter, addr); - sprintf(extra, "0x%08X", data32); - break; - default: - ret = -EINVAL; - goto err_free_ptmp; - } - - kfree(ptmp); - return 0; - -err_free_ptmp: - kfree(ptmp); - return ret; -} - -static int rtw_wx_write32(struct net_device *dev, - struct iw_request_info *info, - union iwreq_data *wrqu, char *extra) -{ - struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev); - - u32 addr; - u32 data32; - u32 bytes; - - bytes = 0; - addr = 0; - data32 = 0; - sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32); - - switch (bytes) { - case 1: - rtw_write8(padapter, addr, (u8)data32); - break; - case 2: - rtw_write16(padapter, addr, (u16)data32); - break; - case 4: - rtw_write32(padapter, addr, data32); - break; - default: - return -EINVAL; - } - - return 0; -} - static int rtw_wx_read_rf(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) @@ -3897,8 +3815,8 @@ static const struct iw_priv_args rtw_pri }; static iw_handler rtw_private_handler[] = { -rtw_wx_write32, /* 0x00 */ -rtw_wx_read32, /* 0x01 */ + NULL, /* 0x00 */ + NULL, /* 0x01 */ NULL, /* 0x02 */ NULL, /* 0x03 */ /* for MM DTV platform */ Patches currently in stable-queue which might be from dan.carpenter@xxxxxxxxxx are queue-5.18/drm-msm-dsi-fix-error-checks-and-return-values-for-d.patch queue-5.18/drm-selftests-missing-error-code-in-igt_buddy_alloc_.patch queue-5.18/md-bitmap-don-t-set-sb-values-if-can-t-pass-sanity-c.patch queue-5.18/pci-rockchip-fix-find_first_zero_bit-limit.patch queue-5.18/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch queue-5.18/dlm-uninitialized-variable-on-error-in-dlm_listen_for_all.patch queue-5.18/drm-msm-return-an-error-pointer-in-msm_gem_prime_get.patch queue-5.18/staging-r8188eu-delete-rtw_wx_read-write32.patch queue-5.18/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch queue-5.18/scsi-iscsi-fix-harmless-double-shift-bug.patch queue-5.18/pci-cadence-fix-find_first_zero_bit-limit.patch queue-5.18/asoc-codecs-fix-error-handling-in-power-domain-init-.patch queue-5.18/drm-tegra-gem-do-not-try-to-dereference-err_ptr.patch queue-5.18/iommu-amd-do-not-call-sleep-while-holding-spinlock.patch queue-5.18/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch queue-5.18/opp-call-of_node_put-on-error-path-in-_bandwidth_sup.patch queue-5.18/scsi-target-tcmu-avoid-holding-xarray-lock-when-call.patch