wifi: rtlwifi: remove unused check_buddy_priv

[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ]

Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global
list of private data structures.

Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match
vendor version 2013.02.07") started adding the private data to that list at
probe time and added a hook, check_buddy_priv to find the private data from
a similar device.

However, that function was never used.

Besides, though there is a lock for that list, it is never used. And when
the probe fails, the private data is never removed from the list. This
would cause a second probe to access freed memory.

Remove the unused hook, structures and members, which will prevent the
potential race condition on the list and its corruption during a second
probe when probe fails.

Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 3c2bdfb56fb4f57fa639fc58f7254733ad99cd6c..c14d7cbaa647250dca0067db1a5421282b9eba11 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -2720,9 +2720,6 @@ MODULE_AUTHOR("Larry Finger       <Larry.FInger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
 
-struct rtl_global_var rtl_global_var = {};
-EXPORT_SYMBOL_GPL(rtl_global_var);
-
 static int __init rtl_core_module_init(void)
 {
        BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION);
@@ -2736,10 +2733,6 @@ static int __init rtl_core_module_init(void)
        /* add debugfs */
        rtl_debugfs_add_topdir();
 
-       /* init some global vars */
-       INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
-       spin_lock_init(&rtl_global_var.glb_list_lock);
-
        return 0;
 }
 

diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
index f081a9a90563f5388224df32f76eddd18cee0720..f3a6a43a42eca88d399d9519a844cdba28437f61 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/base.h
+++ b/drivers/net/wireless/realtek/rtlwifi/base.h
@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
 u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
 void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
 u8 rtl_tid_to_ac(u8 tid);
-extern struct rtl_global_var rtl_global_var;
 void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
 
 #endif

diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index 0dcf5350e0885f6452a0144a12786de2731d67e9..c0a201f1b74e500102163d803e9cf750f3c0d3e7 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw)
        return status;
 }
 
-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
-                                    struct rtl_priv **buddy_priv)
-{
-       struct rtl_priv *rtlpriv = rtl_priv(hw);
-       struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
-       struct rtl_priv *tpriv = NULL, *iter;
-       struct rtl_pci_priv *tpcipriv = NULL;
-
-       if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) {
-               list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list,
-                                   list) {
-                       tpcipriv = (struct rtl_pci_priv *)iter->priv;
-                       rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
-                               "pcipriv->ndis_adapter.funcnumber %x\n",
-                               pcipriv->ndis_adapter.funcnumber);
-                       rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
-                               "tpcipriv->ndis_adapter.funcnumber %x\n",
-                               tpcipriv->ndis_adapter.funcnumber);
-
-                       if (pcipriv->ndis_adapter.busnumber ==
-                           tpcipriv->ndis_adapter.busnumber &&
-                           pcipriv->ndis_adapter.devnumber ==
-                           tpcipriv->ndis_adapter.devnumber &&
-                           pcipriv->ndis_adapter.funcnumber !=
-                           tpcipriv->ndis_adapter.funcnumber) {
-                               tpriv = iter;
-                               break;
-                       }
-               }
-       }
-
-       rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
-               "find_buddy_priv %d\n", tpriv != NULL);
-
-       if (tpriv)
-               *buddy_priv = tpriv;
-
-       return tpriv != NULL;
-}
-
 static void rtl_pci_parse_configuration(struct pci_dev *pdev,
                                        struct ieee80211_hw *hw)
 {
@@ -2013,7 +1973,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
                pcipriv->ndis_adapter.amd_l1_patch);
 
        rtl_pci_parse_configuration(pdev, hw);
-       list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
 
        return true;
 }
@@ -2160,7 +2119,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
        rtlpriv->rtlhal.interface = INTF_PCI;
        rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
        rtlpriv->intf_ops = &rtl_pci_ops;
-       rtlpriv->glb_var = &rtl_global_var;
        rtl_efuse_ops_init(hw);
 
        /* MEM map */
@@ -2318,7 +2276,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
        if (rtlpci->using_msi)
                pci_disable_msi(rtlpci->pdev);
 
-       list_del(&rtlpriv->list);
        if (rtlpriv->io.pci_mem_start != 0) {
                pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
                pci_release_regions(pdev);
@@ -2378,7 +2335,6 @@ const struct rtl_intf_ops rtl_pci_ops = {
        .read_efuse_byte = read_efuse_byte,
        .adapter_start = rtl_pci_start,
        .adapter_stop = rtl_pci_stop,
-       .check_buddy_priv = rtl_pci_check_buddy_priv,
        .adapter_tx = rtl_pci_tx,
        .flush = rtl_pci_flush,
        .reset_trx_ring = rtl_pci_reset_trx_ring,

diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index f22891c73ade17ae6383dc88575f780991482e95..359ee313a0d2bbdec886cf6badcf7c9a90bf6673 100644 (file)
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2335,8 +2335,6 @@ struct rtl_intf_ops {
        void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf);
        int (*adapter_start)(struct ieee80211_hw *hw);
        void (*adapter_stop)(struct ieee80211_hw *hw);
-       bool (*check_buddy_priv)(struct ieee80211_hw *hw,
-                                struct rtl_priv **buddy_priv);
 
        int (*adapter_tx)(struct ieee80211_hw *hw,
                          struct ieee80211_sta *sta,
@@ -2580,14 +2578,6 @@ struct dig_t {
        u32 rssi_max;
 };
 
-struct rtl_global_var {
-       /* from this list we can get
-        * other adapter's rtl_priv
-        */
-       struct list_head glb_priv_list;
-       spinlock_t glb_list_lock;
-};
-
 #define IN_4WAY_TIMEOUT_TIME   (30 * MSEC_PER_SEC)     /* 30 seconds */
 
 struct rtl_btc_info {
@@ -2733,9 +2723,7 @@ struct rtl_scan_list {
 struct rtl_priv {
        struct ieee80211_hw *hw;
        struct completion firmware_loading_complete;
-       struct list_head list;
        struct rtl_priv *buddy_priv;
-       struct rtl_global_var *glb_var;
        struct rtl_dmsp_ctl dmsp_ctl;
        struct rtl_locks locks;
        struct rtl_works works;