staging: rtl8712: fix use after free bugs

commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream.

_Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl()
functions don't do anything except free the "pcmd" pointer.  It
results in a use after free.  Delete them.

Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
Cc: stable <stable@kernel.org>
Reported-by: Zheng Wang <hackerzheng666@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
index 41b667c8385cf9e2ff9a8b6f33064927ecf3795e..2014e8f8994635f547f34310a7e7136709520f74 100644 (file)
--- a/drivers/staging/rtl8712/rtl8712_cmd.c
+++ b/drivers/staging/rtl8712/rtl8712_cmd.c
@@ -128,34 +128,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
        kfree(pdrvcmd->pbuf);
 }
 
-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-       void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
-       struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-       /*  invoke cmd->callback function */
-       pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-       if (!pcmd_callback)
-               r8712_free_cmd_obj(pcmd);
-       else
-               pcmd_callback(padapter, pcmd);
-       return H2C_SUCCESS;
-}
-
-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-       void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
-       struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-       /*  invoke cmd->callback function */
-       pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-       if (!pcmd_callback)
-               r8712_free_cmd_obj(pcmd);
-       else
-               pcmd_callback(padapter, pcmd);
-       return H2C_SUCCESS;
-}
-
 static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
 {
        struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
@@ -224,14 +196,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
        pcmd_r = NULL;
 
        switch (pcmd->cmdcode) {
-       case GEN_CMD_CODE(_Read_MACREG):
-               read_macreg_hdl(padapter, (u8 *)pcmd);
-               pcmd_r = pcmd;
-               break;
-       case GEN_CMD_CODE(_Write_MACREG):
-               write_macreg_hdl(padapter, (u8 *)pcmd);
-               pcmd_r = pcmd;
-               break;
        case GEN_CMD_CODE(_Read_BBREG):
                read_bbreg_hdl(padapter, (u8 *)pcmd);
                break;