staging: rtl8712: fix use after free bugs

[linux-2.6-microblaze.git] / drivers / staging / rtl8712 / rtl8712_cmd.c

diff --git a/drivers/staging/rtl8712/rtl8712_cmd.c b/drivers/staging/rtl8712/rtl8712_cmd.c
index 2326aae..bb7db96 100644 (file)
--- a/drivers/staging/rtl8712/rtl8712_cmd.c
+++ b/drivers/staging/rtl8712/rtl8712_cmd.c
@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf)
        kfree(pdrvcmd->pbuf);
 }
 
-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-       void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
-       struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-       /*  invoke cmd->callback function */
-       pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-       if (!pcmd_callback)
-               r8712_free_cmd_obj(pcmd);
-       else
-               pcmd_callback(padapter, pcmd);
-       return H2C_SUCCESS;
-}
-
-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
-{
-       void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
-       struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
-
-       /*  invoke cmd->callback function */
-       pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
-       if (!pcmd_callback)
-               r8712_free_cmd_obj(pcmd);
-       else
-               pcmd_callback(padapter, pcmd);
-       return H2C_SUCCESS;
-}
-
 static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
 {
        struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter,
        pcmd_r = NULL;
 
        switch (pcmd->cmdcode) {
-       case GEN_CMD_CODE(_Read_MACREG):
-               read_macreg_hdl(padapter, (u8 *)pcmd);
-               pcmd_r = pcmd;
-               break;
-       case GEN_CMD_CODE(_Write_MACREG):
-               write_macreg_hdl(padapter, (u8 *)pcmd);
-               pcmd_r = pcmd;
-               break;
        case GEN_CMD_CODE(_Read_BBREG):
                read_bbreg_hdl(padapter, (u8 *)pcmd);
                break;