From 552aa585faff19ceead7aa840d4ce11830ce34a9 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Tue, 28 Mar 2017 11:56:42 +0300 Subject: hostap: convert hostap_cmd_queue.usecnt from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Kalle Valo --- drivers/net/wireless/intersil/hostap/hostap_hw.c | 12 ++++++------ drivers/net/wireless/intersil/hostap/hostap_wlan.h | 3 ++- 2 files changed, 8 insertions(+), 7 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/hostap/hostap_hw.c b/drivers/net/wireless/intersil/hostap/hostap_hw.c index 04dfd040a650..d4f0b730796e 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_hw.c +++ b/drivers/net/wireless/intersil/hostap/hostap_hw.c @@ -190,7 +190,7 @@ static inline void __hostap_cmd_queue_free(local_info_t *local, } } - if (atomic_dec_and_test(&entry->usecnt) && entry->del_req) + if (refcount_dec_and_test(&entry->usecnt) && entry->del_req) kfree(entry); } @@ -228,7 +228,7 @@ static void prism2_clear_cmd_queue(local_info_t *local) spin_lock_irqsave(&local->cmdlock, flags); list_for_each_safe(ptr, n, &local->cmd_queue) { entry = list_entry(ptr, struct hostap_cmd_queue, list); - atomic_inc(&entry->usecnt); + refcount_inc(&entry->usecnt); printk(KERN_DEBUG "%s: removed pending cmd_queue entry " "(type=%d, cmd=0x%04x, param0=0x%04x)\n", local->dev->name, entry->type, entry->cmd, @@ -350,7 +350,7 @@ static int hfa384x_cmd(struct net_device *dev, u16 cmd, u16 param0, if (entry == NULL) return -ENOMEM; - atomic_set(&entry->usecnt, 1); + refcount_set(&entry->usecnt, 1); entry->type = CMD_SLEEP; entry->cmd = cmd; entry->param0 = param0; @@ -516,7 +516,7 @@ static int hfa384x_cmd_callback(struct net_device *dev, u16 cmd, u16 param0, if (entry == NULL) return -ENOMEM; - atomic_set(&entry->usecnt, 1); + refcount_set(&entry->usecnt, 1); entry->type = CMD_CALLBACK; entry->cmd = cmd; entry->param0 = param0; @@ -666,7 +666,7 @@ static void prism2_cmd_ev(struct net_device *dev) if (!list_empty(&local->cmd_queue)) { entry = list_entry(local->cmd_queue.next, struct hostap_cmd_queue, list); - atomic_inc(&entry->usecnt); + refcount_inc(&entry->usecnt); list_del_init(&entry->list); local->cmd_queue_len--; @@ -718,7 +718,7 @@ static void prism2_cmd_ev(struct net_device *dev) entry = NULL; } if (entry) - atomic_inc(&entry->usecnt); + refcount_inc(&entry->usecnt); } spin_unlock(&local->cmdlock); diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h index ca25283e1c92..5352adb94d50 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h +++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h @@ -6,6 +6,7 @@ #include #include #include +#include #include #include #include @@ -557,7 +558,7 @@ struct hostap_cmd_queue { u16 resp0, res; volatile int issued, issuing; - atomic_t usecnt; + refcount_t usecnt; int del_req; }; -- cgit v1.2.3 From 0aeffa7041d84976432e903cb04e8d7b0edf31ed Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Tue, 28 Mar 2017 11:56:43 +0300 Subject: orinoco_usb: convert request_context.refcount from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Kalle Valo --- drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c index 132f5fbda58b..c84fd8490601 100644 --- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c @@ -64,6 +64,7 @@ #include #include #include +#include #include "mic.h" #include "orinoco.h" @@ -268,7 +269,7 @@ enum ezusb_state { struct request_context { struct list_head list; - atomic_t refcount; + refcount_t refcount; struct completion done; /* Signals that CTX is dead */ int killed; struct urb *outurb; /* OUT for req pkt */ @@ -298,7 +299,7 @@ static inline u8 ezusb_reply_inc(u8 count) static void ezusb_request_context_put(struct request_context *ctx) { - if (!atomic_dec_and_test(&ctx->refcount)) + if (!refcount_dec_and_test(&ctx->refcount)) return; WARN_ON(!ctx->done.done); @@ -328,7 +329,7 @@ static void ezusb_request_timerfn(u_long _ctx) } else { ctx->state = EZUSB_CTX_RESP_TIMEOUT; dev_dbg(&ctx->outurb->dev->dev, "couldn't unlink\n"); - atomic_inc(&ctx->refcount); + refcount_inc(&ctx->refcount); ctx->killed = 1; ezusb_ctx_complete(ctx); ezusb_request_context_put(ctx); @@ -361,7 +362,7 @@ static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv, ctx->out_rid = out_rid; ctx->in_rid = in_rid; - atomic_set(&ctx->refcount, 1); + refcount_set(&ctx->refcount, 1); init_completion(&ctx->done); setup_timer(&ctx->timer, ezusb_request_timerfn, (u_long)ctx); @@ -469,7 +470,7 @@ static void ezusb_req_queue_run(struct ezusb_priv *upriv) list_move_tail(&ctx->list, &upriv->req_active); if (ctx->state == EZUSB_CTX_QUEUED) { - atomic_inc(&ctx->refcount); + refcount_inc(&ctx->refcount); result = usb_submit_urb(ctx->outurb, GFP_ATOMIC); if (result) { ctx->state = EZUSB_CTX_REQSUBMIT_FAIL; @@ -507,7 +508,7 @@ static void ezusb_req_enqueue_run(struct ezusb_priv *upriv, spin_unlock_irqrestore(&upriv->req_lock, flags); goto done; } - atomic_inc(&ctx->refcount); + refcount_inc(&ctx->refcount); list_add_tail(&ctx->list, &upriv->req_pending); spin_unlock_irqrestore(&upriv->req_lock, flags); @@ -1477,7 +1478,7 @@ static inline void ezusb_delete(struct ezusb_priv *upriv) int err; ctx = list_entry(item, struct request_context, list); - atomic_inc(&ctx->refcount); + refcount_inc(&ctx->refcount); ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK; err = usb_unlink_urb(ctx->outurb); -- cgit v1.2.3 From c239838fbd6d5aadac193e02d0cf1866238da97b Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Sat, 6 May 2017 03:48:35 +0300 Subject: p54: allocate enough space for ->used_rxkeys We have the number of longs, but we should be calculating the number of bytes needed. Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo --- drivers/net/wireless/intersil/p54/fwio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/p54/fwio.c b/drivers/net/wireless/intersil/p54/fwio.c index 4ac6764f4897..3076f646c829 100644 --- a/drivers/net/wireless/intersil/p54/fwio.c +++ b/drivers/net/wireless/intersil/p54/fwio.c @@ -176,8 +176,9 @@ int p54_parse_firmware(struct ieee80211_hw *dev, const struct firmware *fw) * keeping a extra list for uploaded keys. */ - priv->used_rxkeys = kzalloc(BITS_TO_LONGS( - priv->rx_keycache_size), GFP_KERNEL); + priv->used_rxkeys = kcalloc(BITS_TO_LONGS(priv->rx_keycache_size), + sizeof(long), + GFP_KERNEL); if (!priv->used_rxkeys) return -ENOMEM; -- cgit v1.2.3 From b080db585384b9f037e015c0c28d1ad33be41dfc Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 16 Jun 2017 14:29:19 +0200 Subject: networking: convert many more places to skb_put_zero() There were many places that my previous spatch didn't find, as pointed out by yuan linyu in various patches. The following spatch found many more and also removes the now unnecessary casts: @@ identifier p, p2; expression len; expression skb; type t, t2; @@ ( -p = skb_put(skb, len); +p = skb_put_zero(skb, len); | -p = (t)skb_put(skb, len); +p = skb_put_zero(skb, len); ) ... when != p ( p2 = (t2)p; -memset(p2, 0, len); | -memset(p, 0, len); ) @@ type t, t2; identifier p, p2; expression skb; @@ t *p; ... ( -p = skb_put(skb, sizeof(t)); +p = skb_put_zero(skb, sizeof(t)); | -p = (t *)skb_put(skb, sizeof(t)); +p = skb_put_zero(skb, sizeof(t)); ) ... when != p ( p2 = (t2)p; -memset(p2, 0, sizeof(*p)); | -memset(p, 0, sizeof(*p)); ) @@ expression skb, len; @@ -memset(skb_put(skb, len), 0, len); +skb_put_zero(skb, len); Apply it to the tree (with one manual fixup to keep the comment in vxlan.c, which spatch removed.) Signed-off-by: Johannes Berg Signed-off-by: David S. Miller --- drivers/net/wireless/intersil/hostap/hostap_ap.c | 7 ++----- drivers/net/wireless/intersil/hostap/hostap_main.c | 4 +--- drivers/net/wireless/intersil/p54/txrx.c | 3 +-- 3 files changed, 4 insertions(+), 10 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c index c995ace153ee..89b5987303a4 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_ap.c +++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c @@ -998,12 +998,10 @@ static void prism2_send_mgmt(struct net_device *dev, fc = type_subtype; hdrlen = hostap_80211_get_hdrlen(cpu_to_le16(type_subtype)); - hdr = (struct ieee80211_hdr *) skb_put(skb, hdrlen); + hdr = skb_put_zero(skb, hdrlen); if (body) memcpy(skb_put(skb, body_len), body, body_len); - memset(hdr, 0, hdrlen); - /* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11 * tx_control instead of using local->tx_control */ @@ -1325,8 +1323,7 @@ static char * ap_auth_make_challenge(struct ap_data *ap) } skb_reserve(skb, ap->crypt->extra_mpdu_prefix_len); - memset(skb_put(skb, WLAN_AUTH_CHALLENGE_LEN), 0, - WLAN_AUTH_CHALLENGE_LEN); + skb_put_zero(skb, WLAN_AUTH_CHALLENGE_LEN); if (ap->crypt->encrypt_mpdu(skb, 0, ap->crypt_priv)) { dev_kfree_skb(skb); kfree(tmpbuf); diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c index 1372b20f931e..400f9b5d620e 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_main.c +++ b/drivers/net/wireless/intersil/hostap/hostap_main.c @@ -1039,9 +1039,7 @@ int prism2_sta_send_mgmt(local_info_t *local, u8 *dst, u16 stype, if (skb == NULL) return -ENOMEM; - mgmt = (struct hostap_ieee80211_mgmt *) - skb_put(skb, IEEE80211_MGMT_HDR_LEN); - memset(mgmt, 0, IEEE80211_MGMT_HDR_LEN); + mgmt = skb_put_zero(skb, IEEE80211_MGMT_HDR_LEN); mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype); memcpy(mgmt->da, dst, ETH_ALEN); memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN); diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c index 5e1c91a80c58..60f9b678ef74 100644 --- a/drivers/net/wireless/intersil/p54/txrx.c +++ b/drivers/net/wireless/intersil/p54/txrx.c @@ -910,8 +910,7 @@ void p54_tx_80211(struct ieee80211_hw *dev, } /* reserve some space for ICV */ len += info->control.hw_key->icv_len; - memset(skb_put(skb, info->control.hw_key->icv_len), 0, - info->control.hw_key->icv_len); + skb_put_zero(skb, info->control.hw_key->icv_len); } else { txhdr->key_type = 0; txhdr->key_len = 0; -- cgit v1.2.3 From 59ae1d127ac0ae404baf414c434ba2651b793f46 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 16 Jun 2017 14:29:20 +0200 Subject: networking: introduce and use skb_put_data() A common pattern with skb_put() is to just want to memcpy() some data into the new space, introduce skb_put_data() for this. An spatch similar to the one for skb_put_zero() converts many of the places using it: @@ identifier p, p2; expression len, skb, data; type t, t2; @@ ( -p = skb_put(skb, len); +p = skb_put_data(skb, data, len); | -p = (t)skb_put(skb, len); +p = skb_put_data(skb, data, len); ) ( p2 = (t2)p; -memcpy(p2, data, len); | -memcpy(p, data, len); ) @@ type t, t2; identifier p, p2; expression skb, data; @@ t *p; ... ( -p = skb_put(skb, sizeof(t)); +p = skb_put_data(skb, data, sizeof(t)); | -p = (t *)skb_put(skb, sizeof(t)); +p = skb_put_data(skb, data, sizeof(t)); ) ( p2 = (t2)p; -memcpy(p2, data, sizeof(*p)); | -memcpy(p, data, sizeof(*p)); ) @@ expression skb, len, data; @@ -memcpy(skb_put(skb, len), data, len); +skb_put_data(skb, data, len); (again, manually post-processed to retain some comments) Reviewed-by: Stephen Hemminger Signed-off-by: Johannes Berg Signed-off-by: David S. Miller --- drivers/net/wireless/intersil/hostap/hostap_80211_tx.c | 2 +- drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +- drivers/net/wireless/intersil/hostap/hostap_hw.c | 11 +++++------ drivers/net/wireless/intersil/hostap/hostap_main.c | 2 +- drivers/net/wireless/intersil/orinoco/main.c | 2 +- drivers/net/wireless/intersil/p54/p54spi.c | 4 ++-- drivers/net/wireless/intersil/p54/txrx.c | 5 +++-- 7 files changed, 14 insertions(+), 14 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/hostap/hostap_80211_tx.c b/drivers/net/wireless/intersil/hostap/hostap_80211_tx.c index 055e11d353ca..c1b10d5117ad 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_80211_tx.c +++ b/drivers/net/wireless/intersil/hostap/hostap_80211_tx.c @@ -242,7 +242,7 @@ netdev_tx_t hostap_data_start_xmit(struct sk_buff *skb, memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len); memcpy(skb_push(skb, hdr_len), &hdr, hdr_len); if (use_wds == WDS_OWN_FRAME) { - memcpy(skb_put(skb, ETH_ALEN), &hdr.addr4, ETH_ALEN); + skb_put_data(skb, &hdr.addr4, ETH_ALEN); } iface->stats.tx_packets++; diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c index 89b5987303a4..91757defb9be 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_ap.c +++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c @@ -1000,7 +1000,7 @@ static void prism2_send_mgmt(struct net_device *dev, hdrlen = hostap_80211_get_hdrlen(cpu_to_le16(type_subtype)); hdr = skb_put_zero(skb, hdrlen); if (body) - memcpy(skb_put(skb, body_len), body, body_len); + skb_put_data(skb, body, body_len); /* FIX: ctrl::ack sending used special HFA384X_TX_CTRL_802_11 * tx_control instead of using local->tx_control */ diff --git a/drivers/net/wireless/intersil/hostap/hostap_hw.c b/drivers/net/wireless/intersil/hostap/hostap_hw.c index d4f0b730796e..72b46eaf3de2 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_hw.c +++ b/drivers/net/wireless/intersil/hostap/hostap_hw.c @@ -2005,7 +2005,7 @@ static void prism2_rx(local_info_t *local) goto rx_dropped; } skb->dev = dev; - memcpy(skb_put(skb, hdr_len), &rxdesc, hdr_len); + skb_put_data(skb, &rxdesc, hdr_len); if (len > 0) res = hfa384x_from_bap(dev, BAP0, skb_put(skb, len), len); @@ -2209,9 +2209,9 @@ static void hostap_tx_callback(local_info_t *local, return; } - memcpy(skb_put(skb, hdrlen), (void *) &txdesc->frame_control, hdrlen); + skb_put_data(skb, (void *)&txdesc->frame_control, hdrlen); if (payload) - memcpy(skb_put(skb, len), payload, len); + skb_put_data(skb, payload, len); skb->dev = local->dev; skb_reset_mac_header(skb); @@ -2362,8 +2362,7 @@ static void prism2_txexc(local_info_t *local) struct sk_buff *skb; skb = dev_alloc_skb(sizeof(txdesc)); if (skb) { - memcpy(skb_put(skb, sizeof(txdesc)), &txdesc, - sizeof(txdesc)); + skb_put_data(skb, &txdesc, sizeof(txdesc)); skb_queue_tail(&local->sta_tx_exc_list, skb); tasklet_schedule(&local->sta_tx_exc_tasklet); } @@ -2460,7 +2459,7 @@ static void prism2_info(local_info_t *local) goto out; } - memcpy(skb_put(skb, sizeof(info)), &info, sizeof(info)); + skb_put_data(skb, &info, sizeof(info)); if (left > 0 && hfa384x_from_bap(dev, BAP0, skb_put(skb, left), left)) { spin_unlock(&local->baplock); diff --git a/drivers/net/wireless/intersil/hostap/hostap_main.c b/drivers/net/wireless/intersil/hostap/hostap_main.c index 400f9b5d620e..a3c066f90afc 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_main.c +++ b/drivers/net/wireless/intersil/hostap/hostap_main.c @@ -1045,7 +1045,7 @@ int prism2_sta_send_mgmt(local_info_t *local, u8 *dst, u16 stype, memcpy(mgmt->sa, dev->dev_addr, ETH_ALEN); memcpy(mgmt->bssid, dst, ETH_ALEN); if (body) - memcpy(skb_put(skb, bodylen), body, bodylen); + skb_put_data(skb, body, bodylen); meta = (struct hostap_skb_tx_data *) skb->cb; memset(meta, 0, sizeof(*meta)); diff --git a/drivers/net/wireless/intersil/orinoco/main.c b/drivers/net/wireless/intersil/orinoco/main.c index d9128bb25e85..f7abc439fb92 100644 --- a/drivers/net/wireless/intersil/orinoco/main.c +++ b/drivers/net/wireless/intersil/orinoco/main.c @@ -792,7 +792,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, } /* Copy the 802.11 header to the skb */ - memcpy(skb_put(skb, hdrlen), &(desc->frame_ctl), hdrlen); + skb_put_data(skb, &(desc->frame_ctl), hdrlen); skb_reset_mac_header(skb); /* If any, copy the data from the card to the skb */ diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c index 7ab2f43ab425..e41bf042352e 100644 --- a/drivers/net/wireless/intersil/p54/p54spi.c +++ b/drivers/net/wireless/intersil/p54/p54spi.c @@ -372,9 +372,9 @@ static int p54spi_rx(struct p54s_priv *priv) } if (len <= READAHEAD_SZ) { - memcpy(skb_put(skb, len), rx_head + 1, len); + skb_put_data(skb, rx_head + 1, len); } else { - memcpy(skb_put(skb, READAHEAD_SZ), rx_head + 1, READAHEAD_SZ); + skb_put_data(skb, rx_head + 1, READAHEAD_SZ); p54spi_spi_read(priv, SPI_ADRS_DMA_DATA, skb_put(skb, len - READAHEAD_SZ), len - READAHEAD_SZ); diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c index 60f9b678ef74..b00c07d72f95 100644 --- a/drivers/net/wireless/intersil/p54/txrx.c +++ b/drivers/net/wireless/intersil/p54/txrx.c @@ -905,8 +905,9 @@ void p54_tx_80211(struct ieee80211_hw *dev, if (info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP) { /* reserve space for the MIC key */ len += 8; - memcpy(skb_put(skb, 8), &(info->control.hw_key->key - [NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY]), 8); + skb_put_data(skb, + &(info->control.hw_key->key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY]), + 8); } /* reserve some space for ICV */ len += info->control.hw_key->icv_len; -- cgit v1.2.3 From 4df864c1d9afb46e2461a9f808d9f11a42d31bad Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 16 Jun 2017 14:29:21 +0200 Subject: networking: make skb_put & friends return void pointers It seems like a historic accident that these return unsigned char *, and in many places that means casts are required, more often than not. Make these functions (skb_put, __skb_put and pskb_put) return void * and remove all the casts across the tree, adding a (u8 *) cast only where the unsigned char pointer was used directly, all done with the following spatch: @@ expression SKB, LEN; typedef u8; identifier fn = { skb_put, __skb_put }; @@ - *(fn(SKB, LEN)) + *(u8 *)fn(SKB, LEN) @@ expression E, SKB, LEN; identifier fn = { skb_put, __skb_put }; type T; @@ - E = ((T *)(fn(SKB, LEN))) + E = fn(SKB, LEN) which actually doesn't cover pskb_put since there are only three users overall. A handful of stragglers were converted manually, notably a macro in drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many instances in net/bluetooth/hci_sock.c. In the former file, I also had to fix one whitespace problem spatch introduced. Signed-off-by: Johannes Berg Signed-off-by: David S. Miller --- drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +- drivers/net/wireless/intersil/p54/fwio.c | 43 ++++++++++++------------ 2 files changed, 22 insertions(+), 23 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c index 91757defb9be..eb9cd6fa9c4d 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_ap.c +++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c @@ -2361,7 +2361,7 @@ static void schedule_packet_send(local_info_t *local, struct sta_info *sta) return; } - hdr = (struct ieee80211_hdr *) skb_put(skb, 16); + hdr = skb_put(skb, 16); /* Generate a fake pspoll frame to start packet delivery */ hdr->frame_control = cpu_to_le16( diff --git a/drivers/net/wireless/intersil/p54/fwio.c b/drivers/net/wireless/intersil/p54/fwio.c index 3076f646c829..52c095c7765f 100644 --- a/drivers/net/wireless/intersil/p54/fwio.c +++ b/drivers/net/wireless/intersil/p54/fwio.c @@ -206,7 +206,7 @@ static struct sk_buff *p54_alloc_skb(struct p54_common *priv, u16 hdr_flags, return NULL; skb_reserve(skb, priv->tx_hdr_len); - hdr = (struct p54_hdr *) skb_put(skb, sizeof(*hdr)); + hdr = skb_put(skb, sizeof(*hdr)); hdr->flags = cpu_to_le16(hdr_flags); hdr->len = cpu_to_le16(payload_len); hdr->type = cpu_to_le16(type); @@ -236,8 +236,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf, mutex_lock(&priv->eeprom_mutex); priv->eeprom = buf; - eeprom_hdr = (struct p54_eeprom_lm86 *) skb_put(skb, - eeprom_hdr_size + len); + eeprom_hdr = skb_put(skb, eeprom_hdr_size + len); if (priv->fw_var < 0x509) { eeprom_hdr->v1.offset = cpu_to_le16(offset); @@ -273,7 +272,7 @@ int p54_update_beacon_tim(struct p54_common *priv, u16 aid, bool set) if (unlikely(!skb)) return -ENOMEM; - tim = (struct p54_tim *) skb_put(skb, sizeof(*tim)); + tim = skb_put(skb, sizeof(*tim)); tim->count = 1; tim->entry[0] = cpu_to_le16(set ? (aid | 0x8000) : aid); p54_tx(priv, skb); @@ -290,7 +289,7 @@ int p54_sta_unlock(struct p54_common *priv, u8 *addr) if (unlikely(!skb)) return -ENOMEM; - sta = (struct p54_sta_unlock *)skb_put(skb, sizeof(*sta)); + sta = skb_put(skb, sizeof(*sta)); memcpy(sta->addr, addr, ETH_ALEN); p54_tx(priv, skb); return 0; @@ -310,7 +309,7 @@ int p54_tx_cancel(struct p54_common *priv, __le32 req_id) if (unlikely(!skb)) return -ENOMEM; - cancel = (struct p54_txcancel *)skb_put(skb, sizeof(*cancel)); + cancel = skb_put(skb, sizeof(*cancel)); cancel->req_id = req_id; p54_tx(priv, skb); return 0; @@ -327,7 +326,7 @@ int p54_setup_mac(struct p54_common *priv) if (!skb) return -ENOMEM; - setup = (struct p54_setup_mac *) skb_put(skb, sizeof(*setup)); + setup = skb_put(skb, sizeof(*setup)); if (!(priv->hw->conf.flags & IEEE80211_CONF_IDLE)) { switch (priv->mode) { case NL80211_IFTYPE_STATION: @@ -413,18 +412,18 @@ int p54_scan(struct p54_common *priv, u16 mode, u16 dwell) if (!skb) return -ENOMEM; - head = (struct p54_scan_head *) skb_put(skb, sizeof(*head)); + head = skb_put(skb, sizeof(*head)); memset(head->scan_params, 0, sizeof(head->scan_params)); head->mode = cpu_to_le16(mode); head->dwell = cpu_to_le16(dwell); head->freq = freq; if (priv->rxhw == PDR_SYNTH_FRONTEND_LONGBOW) { - __le16 *pa_power_points = (__le16 *) skb_put(skb, 2); + __le16 *pa_power_points = skb_put(skb, 2); *pa_power_points = cpu_to_le16(0x0c); } - iq_autocal = (void *) skb_put(skb, sizeof(*iq_autocal)); + iq_autocal = skb_put(skb, sizeof(*iq_autocal)); for (i = 0; i < priv->iq_autocal_len; i++) { if (priv->iq_autocal[i].freq != freq) continue; @@ -437,9 +436,9 @@ int p54_scan(struct p54_common *priv, u16 mode, u16 dwell) goto err; if (priv->rxhw == PDR_SYNTH_FRONTEND_LONGBOW) - body = (void *) skb_put(skb, sizeof(body->longbow)); + body = skb_put(skb, sizeof(body->longbow)); else - body = (void *) skb_put(skb, sizeof(body->normal)); + body = skb_put(skb, sizeof(body->normal)); for (i = 0; i < priv->output_limit->entries; i++) { __le16 *entry_freq = (void *) (priv->output_limit->data + @@ -500,25 +499,25 @@ int p54_scan(struct p54_common *priv, u16 mode, u16 dwell) goto err; if ((priv->fw_var >= 0x500) && (priv->fw_var < 0x509)) { - rate = (void *) skb_put(skb, sizeof(*rate)); + rate = skb_put(skb, sizeof(*rate)); rate->basic_rate_mask = cpu_to_le32(priv->basic_rate_mask); for (i = 0; i < sizeof(rate->rts_rates); i++) rate->rts_rates[i] = i; } - rssi = (struct pda_rssi_cal_entry *) skb_put(skb, sizeof(*rssi)); + rssi = skb_put(skb, sizeof(*rssi)); rssi_data = p54_rssi_find(priv, le16_to_cpu(freq)); rssi->mul = cpu_to_le16(rssi_data->mul); rssi->add = cpu_to_le16(rssi_data->add); if (priv->rxhw == PDR_SYNTH_FRONTEND_LONGBOW) { /* Longbow frontend needs ever more */ - rssi = (void *) skb_put(skb, sizeof(*rssi)); + rssi = skb_put(skb, sizeof(*rssi)); rssi->mul = cpu_to_le16(rssi_data->longbow_unkn); rssi->add = cpu_to_le16(rssi_data->longbow_unk2); } if (priv->fw_var >= 0x509) { - rate = (void *) skb_put(skb, sizeof(*rate)); + rate = skb_put(skb, sizeof(*rate)); rate->basic_rate_mask = cpu_to_le32(priv->basic_rate_mask); for (i = 0; i < sizeof(rate->rts_rates); i++) rate->rts_rates[i] = i; @@ -550,7 +549,7 @@ int p54_set_leds(struct p54_common *priv) if (unlikely(!skb)) return -ENOMEM; - led = (struct p54_led *) skb_put(skb, sizeof(*led)); + led = skb_put(skb, sizeof(*led)); led->flags = cpu_to_le16(0x0003); led->mask[0] = led->mask[1] = cpu_to_le16(priv->softled_state); led->delay[0] = cpu_to_le16(1); @@ -570,7 +569,7 @@ int p54_set_edcf(struct p54_common *priv) if (unlikely(!skb)) return -ENOMEM; - edcf = (struct p54_edcf *)skb_put(skb, sizeof(*edcf)); + edcf = skb_put(skb, sizeof(*edcf)); if (priv->use_short_slot) { edcf->slottime = 9; edcf->sifs = 0x10; @@ -615,7 +614,7 @@ int p54_set_ps(struct p54_common *priv) if (!skb) return -ENOMEM; - psm = (struct p54_psm *)skb_put(skb, sizeof(*psm)); + psm = skb_put(skb, sizeof(*psm)); psm->mode = cpu_to_le16(mode); psm->aid = cpu_to_le16(priv->aid); for (i = 0; i < ARRAY_SIZE(psm->intervals); i++) { @@ -644,7 +643,7 @@ int p54_init_xbow_synth(struct p54_common *priv) if (unlikely(!skb)) return -ENOMEM; - xbow = (struct p54_xbow_synth *)skb_put(skb, sizeof(*xbow)); + xbow = skb_put(skb, sizeof(*xbow)); xbow->magic1 = cpu_to_le16(0x1); xbow->magic2 = cpu_to_le16(0x2); xbow->freq = cpu_to_le16(5390); @@ -664,7 +663,7 @@ int p54_upload_key(struct p54_common *priv, u8 algo, int slot, u8 idx, u8 len, if (unlikely(!skb)) return -ENOMEM; - rxkey = (struct p54_keycache *)skb_put(skb, sizeof(*rxkey)); + rxkey = skb_put(skb, sizeof(*rxkey)); rxkey->entry = slot; rxkey->key_id = idx; rxkey->key_type = algo; @@ -744,7 +743,7 @@ int p54_set_groupfilter(struct p54_common *priv) if (!skb) return -ENOMEM; - grp = (struct p54_group_address_table *)skb_put(skb, sizeof(*grp)); + grp = skb_put(skb, sizeof(*grp)); on = !(priv->filter_flags & FIF_ALLMULTI) && (priv->mc_maclist_num > 0 && -- cgit v1.2.3 From d58ff35122847a83ba55394e2ae3a1527b6febf5 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Fri, 16 Jun 2017 14:29:23 +0200 Subject: networking: make skb_push & __skb_push return void pointers It seems like a historic accident that these return unsigned char *, and in many places that means casts are required, more often than not. Make these functions return void * and remove all the casts across the tree, adding a (u8 *) cast only where the unsigned char pointer was used directly, all done with the following spatch: @@ expression SKB, LEN; typedef u8; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; @@ - *(fn(SKB, LEN)) + *(u8 *)fn(SKB, LEN) @@ expression E, SKB, LEN; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; type T; @@ - E = ((T *)(fn(SKB, LEN))) + E = fn(SKB, LEN) @@ expression SKB, LEN; identifier fn = { skb_push, __skb_push, skb_push_rcsum }; @@ - fn(SKB, LEN)[0] + *(u8 *)fn(SKB, LEN) Note that the last part there converts from push(...)[0] to the more idiomatic *(u8 *)push(...). Signed-off-by: Johannes Berg Signed-off-by: David S. Miller --- drivers/net/wireless/intersil/hostap/hostap_80211_rx.c | 8 +++----- drivers/net/wireless/intersil/orinoco/main.c | 7 +++---- drivers/net/wireless/intersil/p54/txrx.c | 4 ++-- drivers/net/wireless/intersil/prism54/islpci_eth.c | 5 +---- 4 files changed, 9 insertions(+), 15 deletions(-) (limited to 'drivers/net/wireless/intersil') diff --git a/drivers/net/wireless/intersil/hostap/hostap_80211_rx.c b/drivers/net/wireless/intersil/hostap/hostap_80211_rx.c index 34dbddbf3f9b..6d8b64ca1a63 100644 --- a/drivers/net/wireless/intersil/hostap/hostap_80211_rx.c +++ b/drivers/net/wireless/intersil/hostap/hostap_80211_rx.c @@ -131,8 +131,7 @@ int prism2_rx_80211(struct net_device *dev, struct sk_buff *skb, if (prism_header == 1) { struct linux_wlan_ng_prism_hdr *hdr; - hdr = (struct linux_wlan_ng_prism_hdr *) - skb_push(skb, phdrlen); + hdr = skb_push(skb, phdrlen); memset(hdr, 0, phdrlen); hdr->msgcode = LWNG_CAP_DID_BASE; hdr->msglen = sizeof(*hdr); @@ -153,8 +152,7 @@ hdr->f.status = s; hdr->f.len = l; hdr->f.data = d #undef LWNG_SETVAL } else if (prism_header == 2) { struct linux_wlan_ng_cap_hdr *hdr; - hdr = (struct linux_wlan_ng_cap_hdr *) - skb_push(skb, phdrlen); + hdr = skb_push(skb, phdrlen); memset(hdr, 0, phdrlen); hdr->version = htonl(LWNG_CAPHDR_VERSION); hdr->length = htonl(phdrlen); @@ -172,7 +170,7 @@ hdr->f.status = s; hdr->f.len = l; hdr->f.data = d hdr->encoding = htonl(1); /* cck */ } else if (prism_header == 3) { struct hostap_radiotap_rx *hdr; - hdr = (struct hostap_radiotap_rx *)skb_push(skb, phdrlen); + hdr = skb_push(skb, phdrlen); memset(hdr, 0, phdrlen); hdr->hdr.it_len = cpu_to_le16(phdrlen); hdr->hdr.it_present = diff --git a/drivers/net/wireless/intersil/orinoco/main.c b/drivers/net/wireless/intersil/orinoco/main.c index f7abc439fb92..28dac36d7c4c 100644 --- a/drivers/net/wireless/intersil/orinoco/main.c +++ b/drivers/net/wireless/intersil/orinoco/main.c @@ -396,7 +396,7 @@ int orinoco_process_xmit_skb(struct sk_buff *skb, memcpy(hdr.encap, encaps_hdr, sizeof(encaps_hdr)); /* Make room for the new header, and copy it in */ - eh = (struct ethhdr *) skb_push(skb, ENCAPS_OVERHEAD); + eh = skb_push(skb, ENCAPS_OVERHEAD); memcpy(eh, &hdr, sizeof(hdr)); } @@ -1029,11 +1029,10 @@ static void orinoco_rx(struct net_device *dev, /* These indicate a SNAP within 802.2 LLC within 802.11 frame which we'll need to de-encapsulate to the original EthernetII frame. */ - hdr = (struct ethhdr *)skb_push(skb, - ETH_HLEN - ENCAPS_OVERHEAD); + hdr = skb_push(skb, ETH_HLEN - ENCAPS_OVERHEAD); } else { /* 802.3 frame - prepend 802.3 header as is */ - hdr = (struct ethhdr *)skb_push(skb, ETH_HLEN); + hdr = skb_push(skb, ETH_HLEN); hdr->h_proto = htons(length); } memcpy(hdr->h_dest, desc->addr1, ETH_ALEN); diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c index b00c07d72f95..3a4214d362ff 100644 --- a/drivers/net/wireless/intersil/p54/txrx.c +++ b/drivers/net/wireless/intersil/p54/txrx.c @@ -815,8 +815,8 @@ void p54_tx_80211(struct ieee80211_hw *dev, } } - txhdr = (struct p54_tx_data *) skb_push(skb, sizeof(*txhdr) + padding); - hdr = (struct p54_hdr *) skb_push(skb, sizeof(*hdr)); + txhdr = skb_push(skb, sizeof(*txhdr) + padding); + hdr = skb_push(skb, sizeof(*hdr)); if (padding) hdr_flags |= P54_HDR_FLAG_DATA_ALIGN; diff --git a/drivers/net/wireless/intersil/prism54/islpci_eth.c b/drivers/net/wireless/intersil/prism54/islpci_eth.c index d83f6332019e..9b0ded733294 100644 --- a/drivers/net/wireless/intersil/prism54/islpci_eth.c +++ b/drivers/net/wireless/intersil/prism54/islpci_eth.c @@ -276,10 +276,7 @@ islpci_monitor_rx(islpci_private *priv, struct sk_buff **skb) } /* make room for the new header and fill it. */ - avs = - (struct avs_80211_1_header *) skb_push(*skb, - sizeof (struct - avs_80211_1_header)); + avs = skb_push(*skb, sizeof(struct avs_80211_1_header)); avs->version = cpu_to_be32(P80211CAPTURE_VERSION); avs->length = cpu_to_be32(sizeof (struct avs_80211_1_header)); -- cgit v1.2.3