ubuntu/rsi driver has several issues as picked up by static analysis

[Colin Ian King]

** CID 1438209: Memory - corruptions (OVERRUN)
/ubuntu/rsi/rsi_91x_core.c: 352 in rsi_core_qos_processor()

________________________________________________________________________________________________________
*** CID 1438209: Memory - corruptions (OVERRUN)
/ubuntu/rsi/rsi_91x_core.c: 352 in rsi_core_qos_processor()
346
347 if (status) {
348 mutex_unlock(&common->tx_lock);
349 break;
350 }
351
>>> CID 1438209: Memory - corruptions (OVERRUN)
>>> Overrunning array "common->tx_stats.total_tx_pkt_send" of 5 4-byte elements at element index 5 (byte offset 20) using index "q_num" (which evaluates to 5).
352 common->tx_stats.total_tx_pkt_send[q_num]++;
353
354 tstamp_2 = jiffies;
355 mutex_unlock(&common->tx_lock);
356
357 if (tstamp_2 > tstamp_1 + (300 * HZ / 1000))

** CID 1438210: Resource leaks (RESOURCE_LEAK)
/ubuntu/rsi/rsi_91x_hci.c: 274 in rsi_deregister_bt()

________________________________________________________________________________________________________
*** CID 1438210: Resource leaks (RESOURCE_LEAK)
/ubuntu/rsi/rsi_91x_hci.c: 274 in rsi_deregister_bt()
268 cmd_frame->q_no = RSI_BT_MGMT_Q;
269 cmd_frame->pkt_type = RSI_BT_PKT_TYPE_DEREGISTR;
270
271 skb_put(skb, sizeof(struct rsi_bt_cmd_frame));
272
273 //return rsi_coex_send_pkt(common, skb, RSI_BT_Q);
>>> CID 1438210: Resource leaks (RESOURCE_LEAK)
>>> Variable "skb" going out of scope leaks the storage it points to.
274 return common->priv->host_intf_ops->write_pkt(common->priv, skb->data, skb->len);
275 }
276 EXPORT_SYMBOL_GPL(rsi_deregister_bt);
277
278 int rsi_hci_recv_pkt(struct rsi_common *common, u8 *pkt)
279 {

** CID 1438211: Resource leaks (RESOURCE_LEAK)
/ubuntu/rsi/rsi_91x_hci.c: 249 in rsi_send_rfmode_frame()

________________________________________________________________________________________________________
*** CID 1438211: Resource leaks (RESOURCE_LEAK)
/ubuntu/rsi/rsi_91x_hci.c: 249 in rsi_send_rfmode_frame()
243 cmd_frame->bt_rf_tx_power_mode = 0;
244 cmd_frame->bt_rf_tx_power_mode = 0;
245
246 skb_put(skb, sizeof(struct rsi_bt_rfmode_frame));
247
248 // return rsi_coex_send_pkt(common, skb, RSI_BT_Q);
>>> CID 1438211: Resource leaks (RESOURCE_LEAK)
>>> Variable "skb" going out of scope leaks the storage it points to.
249 return common->priv->host_intf_ops->write_pkt(common->priv, skb->data, skb->len);
250 }
251 EXPORT_SYMBOL_GPL(rsi_send_rfmode_frame);
252
253 int rsi_deregister_bt(struct rsi_common *common)
254 {

** CID 1438212: Null pointer dereferences (REVERSE_INULL)
/ubuntu/rsi/rsi_91x_sdio.c: 1388 in rsi_freeze()

________________________________________________________________________________________________________
*** CID 1438212: Null pointer dereferences (REVERSE_INULL)
/ubuntu/rsi/rsi_91x_sdio.c: 1388 in rsi_freeze()
1382 struct rsi_91x_sdiodev *sdev =
1383 (struct rsi_91x_sdiodev *)adapter->rsi_dev;
1384 #endif
1385
1386 ven_rsi_dbg(INFO_ZONE, "SDIO Bus freeze ===>\n");
1387
>>> CID 1438212: Null pointer dereferences (REVERSE_INULL)
>>> Null-checking "adapter" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
1388 if (!adapter) {
1389 ven_rsi_dbg(ERR_ZONE, "Device is not ready\n");
1390 return -ENODEV;
1391 }
1392
1393 common->suspend_in_prog = true;

** CID 1438213: Control flow issues (UNREACHABLE)
/ubuntu/rsi/rsi_91x_usb.c: 497 in rsi_usb_check_queue_status()

________________________________________________________________________________________________________
*** CID 1438213: Control flow issues (UNREACHABLE)
/ubuntu/rsi/rsi_91x_usb.c: 497 in rsi_usb_check_queue_status()
491 struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev;
492 int status;
493 u32 buf_status = 0;
494
495 return QUEUE_NOT_FULL;
496
>>> CID 1438213: Control flow issues (UNREACHABLE)
>>> This code cannot be reached: "if (adapter->priv->fsm_stat...".
497 if (adapter->priv->fsm_state != FSM_MAC_INIT_DONE)
498 return QUEUE_NOT_FULL;
499
500 status = rsi_usb_reg_read(dev->usbdev, adapter->usb_buffer_status_reg,
501 &buf_status, 2);
502 if (status < 0)

[Amitkumar Karwar (amitkarwar)]

1.2RC15 rsi driver includes fixes for these issues

[Kleber Sacilotto de Souza (kleber-souza)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Kleber Sacilotto de Souza (kleber-souza)]

rsi driver verified to be working as expected, as reported on bug #1697829.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.4.0-89.112

---------------
linux (4.4.0-89.112) xenial; urgency=low

  * CVE-2017-7533
    - dentry name snapshots

linux (4.4.0-88.111) xenial; urgency=low

  * linux: 4.4.0-88.111 -proposed tracker (LP: #1705270)

  * [Xenial] nvme: Quirks for PM1725 controllers (LP: #1704435)
    - nvme: Quirks for PM1725 controllers

  * Upgrade Redpine WLAN/BT driver to ver. 1.2 (production release)
    (LP: #1697829)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * ubuntu/rsi driver has several issues as picked up by static analysis
    (LP: #1694733)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * Redpine vendor driver - Switching to AP mode causes kernel panic
    (LP: #1700941)
    - SAUCE: Redpine: Upgrade to ver. 1.2 production release

  * CVE-2017-10810
    - drm/virtio: don't leak bo on drm_gem_object_init failure

  * Ath10k to read different board data file if specify in SMBIOS (LP: #1666742)
    - ath10k: search SMBIOS for OEM board file extension

  * make snap-pkg support (LP: #1700747)
    - SAUCE: make snap-pkg support

  * ISST-LTE: Briggs:Stratton:UbuntuKVM: ics_opal_set_affinity on host kernel
    log using Intel X710 (i40e driver) (LP: #1703663)
    - i40e: use valid online CPU on q_vector initialization

  * Update snapcraft.yaml (LP: #1700480)
    - snapcraft.yaml: various improvements

  * Xenial update to 4.4.76 stable release (LP: #1702863)
    - ipv6: release dst on error in ip6_dst_lookup_tail
    - net: don't call strlen on non-terminated string in dev_set_alias()
    - decnet: dn_rtmsg: Improve input length sanitization in
      dnrmg_receive_user_skb
    - net: Zero ifla_vf_info in rtnl_fill_vfinfo()
    - af_unix: Add sockaddr length checks before accessing sa_family in bind and
      connect handlers
    - Fix an intermittent pr_emerg warning about lo becoming free.
    - net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
    - igmp: acquire pmc lock for ip_mc_clear_src()
    - igmp: add a missing spin_lock_init()
    - ipv6: fix calling in6_ifa_hold incorrectly for dad work
    - net/mlx5: Wait for FW readiness before initializing command interface
    - decnet: always not take dst->__refcnt when inserting dst into hash table
    - net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
    - sfc: provide dummy definitions of vswitch functions
    - ipv6: Do not leak throw route references
    - rtnetlink: add IFLA_GROUP to ifla_policy
    - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
    - netfilter: synproxy: fix conntrackd interaction
    - NFSv4: fix a reference leak caused WARNING messages
    - drm/ast: Handle configuration without P2A bridge
    - mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
    - MIPS: Avoid accidental raw backtrace
    - MIPS: pm-cps: Drop manual cache-line alignment of ready_count
    - MIPS: Fix IRQ tracing & lockdep when rescheduling
    - ALSA: hda - Fix endless loop of codec configure
    - ALSA: hda - set input_path bitmap to zero after moving it to new place
    - drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
    - usb: gadget: f_fs: Fix possi...