From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 7 Jun 2022 09:33:53 +0000 (+0200)
Subject: 5.15-stable patches
X-Git-Tag: v5.10.121~45
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c0e6ff3faccd95ba76cd1ab86f7037f842a30769;p=thirdparty%2Fkernel%2Fstable-queue.git

5.15-stable patches

added patches:
	staging-r8188eu-delete-rtw_wx_read-write32.patch
---

diff --git a/queue-5.15/series b/queue-5.15/series
index d8404ac916d..2a23b4274dc 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -651,3 +651,4 @@ net-ipa-fix-page-free-in-ipa_endpoint_replenish_one.patch
 kseltest-cgroup-make-test_stress.sh-work-if-run-interactively.patch
 list-test-add-a-test-for-list_is_head.patch
 revert-random-use-static-branch-for-crng_ready.patch
+staging-r8188eu-delete-rtw_wx_read-write32.patch
diff --git a/queue-5.15/staging-r8188eu-delete-rtw_wx_read-write32.patch b/queue-5.15/staging-r8188eu-delete-rtw_wx_read-write32.patch
new file mode 100644
index 00000000000..e493bd163a8
--- /dev/null
+++ b/queue-5.15/staging-r8188eu-delete-rtw_wx_read-write32.patch
@@ -0,0 +1,141 @@
+From 4d0cc9e0e53e9946d7b8dc58279c62dfa7a2191b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 19 May 2022 08:17:20 +0300
+Subject: staging: r8188eu: delete rtw_wx_read/write32()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 4d0cc9e0e53e9946d7b8dc58279c62dfa7a2191b upstream.
+
+These debugging tools let you call:
+
+	status = usb_control_msg_recv/send(udev, 0, REALTEK_USB_VENQT_CMD_REQ,
+				      REALTEK_USB_VENQT_READ/WRITE, value,
+				      REALTEK_USB_VENQT_CMD_IDX, io_buf,
+				      size, RTW_USB_CONTROL_MSG_TIMEOUT,
+				      GFP_KERNEL);
+
+with a user controlled "value" in the 0-0xffff range.  It's not a valid
+API.
+
+Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YoXS4OaD1oauPvmj@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/r8188eu/os_dep/ioctl_linux.c |   97 ---------------------------
+ 1 file changed, 2 insertions(+), 95 deletions(-)
+
+--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+@@ -2052,99 +2052,6 @@ static int rtw_wx_get_nick(struct net_de
+ 	return 0;
+ }
+ 
+-static int rtw_wx_read32(struct net_device *dev,
+-			    struct iw_request_info *info,
+-			    union iwreq_data *wrqu, char *extra)
+-{
+-	struct adapter *padapter;
+-	struct iw_point *p;
+-	u16 len;
+-	u32 addr;
+-	u32 data32;
+-	u32 bytes;
+-	u8 *ptmp;
+-	int ret;
+-
+-	padapter = (struct adapter *)rtw_netdev_priv(dev);
+-	p = &wrqu->data;
+-	len = p->length;
+-	ptmp = kmalloc(len, GFP_KERNEL);
+-	if (!ptmp)
+-		return -ENOMEM;
+-
+-	if (copy_from_user(ptmp, p->pointer, len)) {
+-		kfree(ptmp);
+-		return -EFAULT;
+-	}
+-
+-	bytes = 0;
+-	addr = 0;
+-	sscanf(ptmp, "%d,%x", &bytes, &addr);
+-
+-	switch (bytes) {
+-	case 1:
+-		data32 = rtw_read8(padapter, addr);
+-		sprintf(extra, "0x%02X", data32);
+-		break;
+-	case 2:
+-		data32 = rtw_read16(padapter, addr);
+-		sprintf(extra, "0x%04X", data32);
+-		break;
+-	case 4:
+-		data32 = rtw_read32(padapter, addr);
+-		sprintf(extra, "0x%08X", data32);
+-		break;
+-	default:
+-		DBG_88E(KERN_INFO "%s: usage> read [bytes],[address(hex)]\n", __func__);
+-		ret = -EINVAL;
+-		goto err_free_ptmp;
+-	}
+-	DBG_88E(KERN_INFO "%s: addr = 0x%08X data =%s\n", __func__, addr, extra);
+-
+-	kfree(ptmp);
+-	return 0;
+-
+-err_free_ptmp:
+-	kfree(ptmp);
+-	return ret;
+-}
+-
+-static int rtw_wx_write32(struct net_device *dev,
+-			    struct iw_request_info *info,
+-			    union iwreq_data *wrqu, char *extra)
+-{
+-	struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
+-
+-	u32 addr;
+-	u32 data32;
+-	u32 bytes;
+-
+-	bytes = 0;
+-	addr = 0;
+-	data32 = 0;
+-	sscanf(extra, "%d,%x,%x", &bytes, &addr, &data32);
+-
+-	switch (bytes) {
+-	case 1:
+-		rtw_write8(padapter, addr, (u8)data32);
+-		DBG_88E(KERN_INFO "%s: addr = 0x%08X data = 0x%02X\n", __func__, addr, (u8)data32);
+-		break;
+-	case 2:
+-		rtw_write16(padapter, addr, (u16)data32);
+-		DBG_88E(KERN_INFO "%s: addr = 0x%08X data = 0x%04X\n", __func__, addr, (u16)data32);
+-		break;
+-	case 4:
+-		rtw_write32(padapter, addr, data32);
+-		DBG_88E(KERN_INFO "%s: addr = 0x%08X data = 0x%08X\n", __func__, addr, data32);
+-		break;
+-	default:
+-		DBG_88E(KERN_INFO "%s: usage> write [bytes],[address(hex)],[data(hex)]\n", __func__);
+-		return -EINVAL;
+-	}
+-
+-	return 0;
+-}
+-
+ static int rtw_wx_read_rf(struct net_device *dev,
+ 			    struct iw_request_info *info,
+ 			    union iwreq_data *wrqu, char *extra)
+@@ -6579,8 +6486,8 @@ static const struct iw_priv_args rtw_pri
+ };
+ 
+ static iw_handler rtw_private_handler[] = {
+-rtw_wx_write32,				/* 0x00 */
+-rtw_wx_read32,				/* 0x01 */
++	NULL,				/* 0x00 */
++	NULL,				/* 0x01 */
+ rtw_drvext_hdl,				/* 0x02 */
+ rtw_mp_ioctl_hdl,			/* 0x03 */
+