[PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg

[PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg

[Zhang Shurong]

If there is a failure during copy_from_user or user-provided data
buffer is invalid, rtw_debugfs_set_write_reg should return negative
error code instead of a positive value count.

Fix this bug by returning correct error code. Moreover, the check
of buffer against null is removed since it will be handled by
copy_from_user.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index fa3d73b333ba..bc41c5a7acaf 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size,
 
 	tmp_len = (count > size - 1 ? size - 1 : count);
 
-	if (!buffer || copy_from_user(tmp, buffer, tmp_len))
-		return count;
+	if (copy_from_user(tmp, buffer, tmp_len))
+		return -EFAULT;
 
 	tmp[tmp_len] = '\0';
 
@@ -338,14 +338,17 @@ static ssize_t rtw_debugfs_set_write_reg(struct file *filp,
 	char tmp[32 + 1];
 	u32 addr, val, len;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	if (ret < 0)
+		return ret;
 
 	/* write BB/MAC register */
 	num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
 
 	if (num !=  3)
-		return count;
+		return -EINVAL;
 
 	switch (len) {
 	case 1:
-- 
2.40.0

RE: [PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg

[Ping-Ke Shih]

> -----Original Message-----
> From: Zhang Shurong <zhang_shurong@foxmail.com>
> Sent: Saturday, April 22, 2023 6:05 PM
> To: tony0620emma@gmail.com
> Cc: kvalo@kernel.org; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com;
> linux-wireless@vger.kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Zhang Shurong
> <zhang_shurong@foxmail.com>
> Subject: [PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg
> 
> If there is a failure during copy_from_user or user-provided data
> buffer is invalid, rtw_debugfs_set_write_reg should return negative
> error code instead of a positive value count.
> 
> Fix this bug by returning correct error code. Moreover, the check
> of buffer against null is removed since it will be handled by
> copy_from_user.
> 
> Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
> ---
>  drivers/net/wireless/realtek/rtw88/debug.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
> index fa3d73b333ba..bc41c5a7acaf 100644
> --- a/drivers/net/wireless/realtek/rtw88/debug.c
> +++ b/drivers/net/wireless/realtek/rtw88/debug.c
> @@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size,
> 
>         tmp_len = (count > size - 1 ? size - 1 : count);
> 
> -       if (!buffer || copy_from_user(tmp, buffer, tmp_len))
> -               return count;
> +       if (copy_from_user(tmp, buffer, tmp_len))
> +               return -EFAULT;

This patchset is fine to me. The only thing is this chunk can be first patch,
and squash other patches to second patch because they do the same thing
in the same driver.


> 
>         tmp[tmp_len] = '\0';
> 
> @@ -338,14 +338,17 @@ static ssize_t rtw_debugfs_set_write_reg(struct file *filp,
>         char tmp[32 + 1];
>         u32 addr, val, len;
>         int num;
> +       int ret;
> 
> -       rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
> +       ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
> +       if (ret < 0)
> +               return ret;
> 
>         /* write BB/MAC register */
>         num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
> 
>         if (num !=  3)
> -               return count;
> +               return -EINVAL;
> 
>         switch (len) {
>         case 1:
> --
> 2.40.0

Re: [PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg

[foxmail]

Thank you a lot for your kind reply, I will resend it as 2 patches.

> 2023年4月24日 09:58，Ping-Ke Shih <pkshih@realtek.com> 写道：
> 
>> -----Original Message-----
>> From: Zhang Shurong <zhang_shurong@foxmail.com>
>> Sent: Saturday, April 22, 2023 6:05 PM
>> To: tony0620emma@gmail.com
>> Cc: kvalo@kernel.org; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com;
>> linux-wireless@vger.kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Zhang Shurong
>> <zhang_shurong@foxmail.com>
>> Subject: [PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg
>> 
>> If there is a failure during copy_from_user or user-provided data
>> buffer is invalid, rtw_debugfs_set_write_reg should return negative
>> error code instead of a positive value count.
>> 
>> Fix this bug by returning correct error code. Moreover, the check
>> of buffer against null is removed since it will be handled by
>> copy_from_user.
>> 
>> Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
>> ---
>> drivers/net/wireless/realtek/rtw88/debug.c | 11 +++++++----
>> 1 file changed, 7 insertions(+), 4 deletions(-)
>> 
>> diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
>> index fa3d73b333ba..bc41c5a7acaf 100644
>> --- a/drivers/net/wireless/realtek/rtw88/debug.c
>> +++ b/drivers/net/wireless/realtek/rtw88/debug.c
>> @@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size,
>> 
>>        tmp_len = (count > size - 1 ? size - 1 : count);
>> 
>> -       if (!buffer || copy_from_user(tmp, buffer, tmp_len))
>> -               return count;
>> +       if (copy_from_user(tmp, buffer, tmp_len))
>> +               return -EFAULT;
> 
> This patchset is fine to me. The only thing is this chunk can be first patch,
> and squash other patches to second patch because they do the same thing
> in the same driver.
> 
> 
>> 
>>        tmp[tmp_len] = '\0';
>> 
>> @@ -338,14 +338,17 @@ static ssize_t rtw_debugfs_set_write_reg(struct file *filp,
>>        char tmp[32 + 1];
>>        u32 addr, val, len;
>>        int num;
>> +       int ret;
>> 
>> -       rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
>> +       ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
>> +       if (ret < 0)
>> +               return ret;
>> 
>>        /* write BB/MAC register */
>>        num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
>> 
>>        if (num !=  3)
>> -               return count;
>> +               return -EINVAL;
>> 
>>        switch (len) {
>>        case 1:
>> --
>> 2.40.0
> 
>> -----Original Message-----
>> From: Zhang Shurong <zhang_shurong@foxmail.com>
>> Sent: Saturday, April 22, 2023 6:05 PM
>> To: tony0620emma@gmail.com
>> Cc: kvalo@kernel.org; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com;
>> linux-wireless@vger.kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Zhang Shurong
>> <zhang_shurong@foxmail.com>
>> Subject: [PATCH 01/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_write_reg
>> 
>> If there is a failure during copy_from_user or user-provided data
>> buffer is invalid, rtw_debugfs_set_write_reg should return negative
>> error code instead of a positive value count.
>> 
>> Fix this bug by returning correct error code. Moreover, the check
>> of buffer against null is removed since it will be handled by
>> copy_from_user.
>> 
>> Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
>> ---
>> drivers/net/wireless/realtek/rtw88/debug.c | 11 +++++++----
>> 1 file changed, 7 insertions(+), 4 deletions(-)
>> 
>> diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
>> index fa3d73b333ba..bc41c5a7acaf 100644
>> --- a/drivers/net/wireless/realtek/rtw88/debug.c
>> +++ b/drivers/net/wireless/realtek/rtw88/debug.c
>> @@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size,
>> 
>>        tmp_len = (count > size - 1 ? size - 1 : count);
>> 
>> -       if (!buffer || copy_from_user(tmp, buffer, tmp_len))
>> -               return count;
>> +       if (copy_from_user(tmp, buffer, tmp_len))
>> +               return -EFAULT;
> 
> This patchset is fine to me. The only thing is this chunk can be first patch,
> and squash other patches to second patch because they do the same thing
> in the same driver.
> 
> 
>> 
>>        tmp[tmp_len] = '\0';
>> 
>> @@ -338,14 +338,17 @@ static ssize_t rtw_debugfs_set_write_reg(struct file *filp,
>>        char tmp[32 + 1];
>>        u32 addr, val, len;
>>        int num;
>> +       int ret;
>> 
>> -       rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
>> +       ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
>> +       if (ret < 0)
>> +               return ret;
>> 
>>        /* write BB/MAC register */
>>        num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
>> 
>>        if (num !=  3)
>> -               return count;
>> +               return -EINVAL;
>> 
>>        switch (len) {
>>        case 1:
>> --
>> 2.40.0

[PATCH 02/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_read_reg

[Zhang Shurong]

If there is a failure during copy_from_user or user-provided data
buffer is invalid, rtw_debugfs_set_read_reg should return negative
error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index bc41c5a7acaf..3c3350bb2855 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -201,13 +201,16 @@ static ssize_t rtw_debugfs_set_read_reg(struct file *filp,
 	char tmp[32 + 1];
 	u32 addr, len;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2);
+	if (ret < 0)
+		return ret;
 
 	num = sscanf(tmp, "%x %x", &addr, &len);
 
 	if (num !=  2)
-		return count;
+		return -EINVAL;
 
 	if (len != 1 && len != 2 && len != 4) {
 		rtw_warn(rtwdev, "read reg setting wrong len\n");
-- 
2.40.0

[PATCH 03/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_rsvd_page

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_rsvd_page
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index 3c3350bb2855..d8e872ae4dda 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -291,8 +291,11 @@ static ssize_t rtw_debugfs_set_rsvd_page(struct file *filp,
 	char tmp[32 + 1];
 	u32 offset, page_num;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 2);
+	if (ret < 0)
+		return ret;
 
 	num = sscanf(tmp, "%d %d", &offset, &page_num);
 
-- 
2.40.0

[PATCH 04/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_single_input

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_single_input
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index d8e872ae4dda..f721205185cf 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -320,8 +320,11 @@ static ssize_t rtw_debugfs_set_single_input(struct file *filp,
 	char tmp[32 + 1];
 	u32 input;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	if (ret < 0)
+		return ret;
 
 	num = kstrtoint(tmp, 0, &input);
 
-- 
2.40.0

[PATCH 05/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_h2c

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_h2c
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index f721205185cf..911f0514c497 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -393,8 +393,11 @@ static ssize_t rtw_debugfs_set_h2c(struct file *filp,
 	char tmp[32 + 1];
 	u8 param[8];
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	if (ret < 0)
+		return ret;
 
 	num = sscanf(tmp, "%hhx,%hhx,%hhx,%hhx,%hhx,%hhx,%hhx,%hhx",
 		     &param[0], &param[1], &param[2], &param[3],
-- 
2.40.0

[PATCH 06/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_rf_write

[Zhang Shurong]

If there is a failure during copy_from_user or user-provided data
buffer is invalid, rtw_debugfs_set_rf_write should return negative
error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index 911f0514c497..259e6c15bc78 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -423,14 +423,17 @@ static ssize_t rtw_debugfs_set_rf_write(struct file *filp,
 	char tmp[32 + 1];
 	u32 path, addr, mask, val;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 4);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 4);
+	if (ret < 0)
+		return ret;
 
 	num = sscanf(tmp, "%x %x %x %x", &path, &addr, &mask, &val);
 
 	if (num !=  4) {
 		rtw_warn(rtwdev, "invalid args, [path] [addr] [mask] [val]\n");
-		return count;
+		return -EINVAL;
 	}
 
 	mutex_lock(&rtwdev->mutex);
-- 
2.40.0

[PATCH 07/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_rf_read

[Zhang Shurong]

If there is a failure during copy_from_user or user-provided data
buffer is invalid, rtw_debugfs_set_rf_read should return negative
error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index 259e6c15bc78..e033077d49b0 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -456,14 +456,17 @@ static ssize_t rtw_debugfs_set_rf_read(struct file *filp,
 	char tmp[32 + 1];
 	u32 path, addr, mask;
 	int num;
+	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 3);
+	if (ret < 0)
+		return ret;
 
 	num = sscanf(tmp, "%x %x %x", &path, &addr, &mask);
 
 	if (num !=  3) {
 		rtw_warn(rtwdev, "invalid args, [path] [addr] [mask] [val]\n");
-		return count;
+		return -EINVAL;
 	}
 
 	debugfs_priv->rf_path = path;
-- 
2.40.0

[PATCH 08/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_fix_rate

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_fix_rate
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index e033077d49b0..aef43f3ca364 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -488,7 +488,9 @@ static ssize_t rtw_debugfs_set_fix_rate(struct file *filp,
 	char tmp[32 + 1];
 	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	if (ret < 0)
+		return ret;
 
 	ret = kstrtou8(tmp, 0, &fix_rate);
 	if (ret) {
-- 
2.40.0

[PATCH 09/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_coex_enable

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_coex_enable
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index aef43f3ca364..f9bcb44b42ac 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -883,7 +883,9 @@ static ssize_t rtw_debugfs_set_coex_enable(struct file *filp,
 	bool enable;
 	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	if (ret < 0)
+		return ret;
 
 	ret = kstrtobool(tmp, &enable);
 	if (ret) {
-- 
2.40.0

[PATCH 10/10] wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_fw_crash

[Zhang Shurong]

If there is a failure during copy_from_user, rtw_debugfs_set_fw_crash
should return negative error code instead of a positive value count.

Fix this bug by returning correct error code.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/net/wireless/realtek/rtw88/debug.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index f9bcb44b42ac..700d5183d62a 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -955,7 +955,9 @@ static ssize_t rtw_debugfs_set_fw_crash(struct file *filp,
 	bool input;
 	int ret;
 
-	rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	ret = rtw_debugfs_copy_from_user(tmp, sizeof(tmp), buffer, count, 1);
+	if (ret < 0)
+		return ret;
 
 	ret = kstrtobool(tmp, &input);
 	if (ret)
-- 
2.40.0