Staging: rtl8192su: check for skb == NULL (199ef62a) · Commits · jan.koester / Linux

drivers/staging/rtl8192su/r8192S_firmware.c

+62 −73

Original line number	Original line	Diff line number	Diff line
	@@ -31,11 +31,14 @@
	// Code size		// Code size
	// Created by Roger, 2008.04.10.		// Created by Roger, 2008.04.10.
	//		//
	bool FirmwareDownloadCode(struct net_device dev, u8 code_virtual_address,u32 buffer_len)		bool FirmwareDownloadCode(struct net_device *dev,
			u8 *code_virtual_address,
			u32 buffer_len)
	{		{
	struct r8192_priv *priv = ieee80211_priv(dev);		struct r8192_priv *priv = ieee80211_priv(dev);
	bool rt_status = true;		bool rt_status = true;
	u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE; //Fragmentation might be required in 90/92 but not in 92S		/* Fragmentation might be required in 90/92 but not in 92S */
			u16 frag_threshold = MAX_FIRMWARE_CODE_SIZE;
	u16 frag_length, frag_offset = 0;		u16 frag_length, frag_offset = 0;
	struct sk_buff *skb;		struct sk_buff *skb;
	unsigned char *seg_ptr;		unsigned char *seg_ptr;
	@@ -43,31 +46,30 @@ bool FirmwareDownloadCode(struct net_device dev, u8 code_virtual_address,u32
	u8 bLastIniPkt = 0;		u8 bLastIniPkt = 0;
	u16 ExtraDescOffset = 0;		u16 ExtraDescOffset = 0;

			if (buffer_len >= MAX_FIRMWARE_CODE_SIZE - USB_HWDESC_HEADER_LEN) {
	RT_TRACE(COMP_FIRMWARE, "--->FirmwareDownloadCode()\n" );		RT_TRACE(COMP_ERR, "(%s): Firmware exceeds"
			" MAX_FIRMWARE_CODE_SIZE\n", __func__);
	//MAX_TRANSMIT_BUFFER_SIZE
	if(buffer_len >= MAX_FIRMWARE_CODE_SIZE-USB_HWDESC_HEADER_LEN)
	{
	RT_TRACE(COMP_ERR, "Size over MAX_FIRMWARE_CODE_SIZE! \n");
	goto cmdsend_downloadcode_fail;		goto cmdsend_downloadcode_fail;
	}		}

	ExtraDescOffset = USB_HWDESC_HEADER_LEN;		ExtraDescOffset = USB_HWDESC_HEADER_LEN;

	do {		do {
	if((buffer_len-frag_offset) > frag_threshold)		if((buffer_len-frag_offset) > frag_threshold)
	{
	frag_length = frag_threshold + ExtraDescOffset;		frag_length = frag_threshold + ExtraDescOffset;
	}		else {
	else		frag_length = (u16)(buffer_len -
	{		frag_offset + ExtraDescOffset);
	frag_length = (u16)(buffer_len - frag_offset + ExtraDescOffset);
	bLastIniPkt = 1;		bLastIniPkt = 1;
	}		}
			/*
	/* Allocate skb buffer to contain firmware info and tx descriptor info. */		* Allocate skb buffer to contain firmware info
			* and tx descriptor info.
			*/
	skb = dev_alloc_skb(frag_length);		skb = dev_alloc_skb(frag_length);
			if (skb == NULL) {
			RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
			__func__);
			goto cmdsend_downloadcode_fail;
			}
	memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));		memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));

	tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);		tcb_desc = (cb_desc*)(skb->cb + MAX_DEV_ADDR_SIZE);
	@@ -76,73 +78,60 @@ bool FirmwareDownloadCode(struct net_device dev, u8 code_virtual_address,u32
	tcb_desc->bLastIniPkt = bLastIniPkt;		tcb_desc->bLastIniPkt = bLastIniPkt;

	skb_reserve(skb, ExtraDescOffset);		skb_reserve(skb, ExtraDescOffset);
	seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length-ExtraDescOffset));
	memcpy(seg_ptr, code_virtual_address+frag_offset, (u32)(frag_length-ExtraDescOffset));		seg_ptr = (u8 *)skb_put(skb,
			(u32)(frag_length - ExtraDescOffset));

			memcpy(seg_ptr, code_virtual_address + frag_offset,
			(u32)(frag_length-ExtraDescOffset));

	tcb_desc->txbuf_size = frag_length;		tcb_desc->txbuf_size = frag_length;

	if (!priv->ieee80211->check_nic_enough_desc(dev, tcb_desc->queue_index) \|\|		if (!priv->ieee80211->check_nic_enough_desc(dev, tcb_desc->queue_index) \|\|
	(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index]))\|\|\		(!skb_queue_empty(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index])) \|\|
	(priv->ieee80211->queue_stop) )		(priv->ieee80211->queue_stop)) {
	{
	RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n");		RT_TRACE(COMP_FIRMWARE,"=====================================================> tx full!\n");
	skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);		skb_queue_tail(&priv->ieee80211->skb_waitQ[tcb_desc->queue_index], skb);
	}		} else
	else
	{
	priv->ieee80211->softmac_hard_start_xmit(skb, dev);		priv->ieee80211->softmac_hard_start_xmit(skb, dev);
	}

	frag_offset += (frag_length - ExtraDescOffset);		frag_offset += (frag_length - ExtraDescOffset);

	} while (frag_offset < buffer_len);		} while (frag_offset < buffer_len);

	return rt_status ;		return rt_status ;


	cmdsend_downloadcode_fail:		cmdsend_downloadcode_fail:
	rt_status = false;		rt_status = false;
	RT_TRACE(COMP_ERR, "CmdSendDownloadCode fail !!\n");		RT_TRACE(COMP_ERR, "(%s): failed\n", __func__);
	return rt_status;		return rt_status;

	}		}


	RT_STATUS		RT_STATUS FirmwareEnableCPU(struct net_device *dev)
	FirmwareEnableCPU(struct net_device *dev)
	{		{

	RT_STATUS rtStatus = RT_STATUS_SUCCESS;		RT_STATUS rtStatus = RT_STATUS_SUCCESS;
	u8 tmpU1b, CPUStatus = 0;		u8 tmpU1b, CPUStatus = 0;
	u16 tmpU2b;		u16 tmpU2b;
	u32 iCheckTime = 200;		u32 iCheckTime = 200;

	RT_TRACE(COMP_FIRMWARE, "-->FirmwareEnableCPU()\n" );		/* Enable CPU. */
	// Enable CPU.
	tmpU1b = read_nic_byte(dev, SYS_CLKR);		tmpU1b = read_nic_byte(dev, SYS_CLKR);
	write_nic_byte(dev, SYS_CLKR, (tmpU1b\|SYS_CPU_CLKSEL)); //AFE source		/* AFE source */
			write_nic_byte(dev, SYS_CLKR, (tmpU1b\|SYS_CPU_CLKSEL));
	tmpU2b = read_nic_word(dev, SYS_FUNC_EN);		tmpU2b = read_nic_word(dev, SYS_FUNC_EN);
	write_nic_word(dev, SYS_FUNC_EN, (tmpU2b\|FEN_CPUEN));		write_nic_word(dev, SYS_FUNC_EN, (tmpU2b\|FEN_CPUEN));
			/* Poll IMEM Ready after CPU has refilled. */
	//Polling IMEM Ready after CPU has refilled.		do {
	do
	{
	CPUStatus = read_nic_byte(dev, TCR);		CPUStatus = read_nic_byte(dev, TCR);
	if (CPUStatus & IMEM_RDY)		if (CPUStatus & IMEM_RDY)
	{		/* success */
	RT_TRACE(COMP_FIRMWARE, "IMEM Ready after CPU has refilled.\n");
	break;		break;
	}

	//usleep(100);
	udelay(100);		udelay(100);
	} while (iCheckTime--);		} while (iCheckTime--);
			if (!(CPUStatus & IMEM_RDY)) {
	if(!(CPUStatus & IMEM_RDY))		RT_TRACE(COMP_ERR, "(%s): failed to enable CPU\n", __func__);
	return RT_STATUS_FAILURE;		rtStatus = RT_STATUS_FAILURE;
			}
	RT_TRACE(COMP_FIRMWARE, "<--FirmwareEnableCPU(): rtStatus(%#x)\n", rtStatus);
	return rtStatus;		return rtStatus;
	}		}

drivers/staging/rtl8192su/r8192U_core.c

+0 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1296,7 +1296,6 @@ static int rtl8192_rx_initiate(struct net_device*dev)
	kfree_skb(skb);		kfree_skb(skb);
	break;		break;
	}		}
	// printk("nomal packet IN request!\n");
	usb_fill_bulk_urb(entry, priv->udev,		usb_fill_bulk_urb(entry, priv->udev,
	usb_rcvbulkpipe(priv->udev, 3), skb_tail_pointer(skb),		usb_rcvbulkpipe(priv->udev, 3), skb_tail_pointer(skb),
	RX_URB_SIZE, rtl8192_rx_isr, skb);		RX_URB_SIZE, rtl8192_rx_isr, skb);
	@@ -1310,7 +1309,6 @@ static int rtl8192_rx_initiate(struct net_device*dev)

	/* command packet rx procedure */		/* command packet rx procedure */
	while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB + 3) {		while (skb_queue_len(&priv->rx_queue) < MAX_RX_URB + 3) {
	// printk("command packet IN request!\n");
	skb = __dev_alloc_skb(RX_URB_SIZE ,GFP_KERNEL);		skb = __dev_alloc_skb(RX_URB_SIZE ,GFP_KERNEL);
	if (!skb)		if (!skb)
	break;		break;

drivers/staging/rtl8192su/r819xU_cmdpkt.c

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -26,6 +26,12 @@ bool SendTxCommandPacket(struct net_device dev, void pData, u32 DataLen)
	* (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)		* (It is shared by CmdQ, MgntQ, and USB coalesce DataQ)
	*/		*/
	skb = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);		skb = dev_alloc_skb(USB_HWDESC_HEADER_LEN + DataLen + 4);
			if (skb == NULL) {
			RT_TRACE(COMP_ERR, "(%s): unable to alloc skb buffer\n",
			__func__);
			rtStatus = false;
			return rtStatus;
			}
	memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));		memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
	tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);		tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
	tcb_desc->queue_index = TXCMD_QUEUE;		tcb_desc->queue_index = TXCMD_QUEUE;