A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 12:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

icnss2: Add Null check before dereferencing variables

Browse source 
Add Null check before dereferencing dev for set FW log mode,
force wake request & force wake response. Add ERR_OR_NULL check
for wpss load API gets called for wpss subsystem. Check for qdss
memory segment length.

Change-Id: Id4a43fa9ae332faa7f5741f338d985db8272d17a
Signed-off-by: Vijay Patil <vijaylil@codeaurora.org>
This commit is contained in:
Vijay Patil 2021-07-06 21:21:02 +05:30
commit 550d642faa
2 changed files with 30 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
drivers/soc/qcom/icnss2/main.c
View file

@ -2713,11 +2713,18 @@ EXPORT_SYMBOL(icnss_get_mhi_state);
int icnss_set_fw_log_mode(struct device *dev, uint8_t fw_log_mode)
{
int ret;
struct icnss_priv *priv = dev_get_drvdata(dev);
struct icnss_priv *priv;
if (!dev)
return -ENODEV;
priv = dev_get_drvdata(dev);
if (!priv) {
icnss_pr_err("Platform driver not initialized\n");
return -EINVAL;
}
if (test_bit(ICNSS_FW_DOWN, &penv->state) ||
!test_bit(ICNSS_FW_READY, &penv->state)) {
icnss_pr_err("FW down, ignoring fw_log_mode state: 0x%lx\n",
@ -2737,11 +2744,13 @@ EXPORT_SYMBOL(icnss_set_fw_log_mode);
int icnss_force_wake_request(struct device *dev)
{
struct icnss_priv *priv = dev_get_drvdata(dev);
struct icnss_priv *priv;
if (!dev)
return -ENODEV;
priv = dev_get_drvdata(dev);
if (!priv) {
icnss_pr_err("Platform driver not initialized\n");
return -EINVAL;
@ -2764,11 +2773,13 @@ EXPORT_SYMBOL(icnss_force_wake_request);
int icnss_force_wake_release(struct device *dev)
{
struct icnss_priv *priv = dev_get_drvdata(dev);
struct icnss_priv *priv;
if (!dev)
return -ENODEV;
priv = dev_get_drvdata(dev);
if (!priv) {
icnss_pr_err("Platform driver not initialized\n");
return -EINVAL;
@ -3336,7 +3347,7 @@ static void icnss_wpss_load(struct work_struct *wpss_load_work)
struct icnss_priv *priv = icnss_get_plat_priv();
priv->subsys = subsystem_get("wpss");
if (IS_ERR(priv->subsys))
if (IS_ERR_OR_NULL(priv->subsys))
icnss_pr_err("Failed to load wpss subsys");
}

15
drivers/soc/qcom/icnss2/qmi.c
View file

@ -2078,6 +2078,14 @@ int wlfw_qdss_trace_mem_info_send_sync(struct icnss_priv *priv)
}
req->mem_seg_len = priv->qdss_mem_seg_len;
if (priv->qdss_mem_seg_len > QMI_WLFW_MAX_NUM_MEM_SEG) {
icnss_pr_err("Invalid seg len %u\n",
priv->qdss_mem_seg_len);
ret = -EINVAL;
goto out;
}
for (i = 0; i < req->mem_seg_len; i++) {
icnss_pr_dbg("Memory for FW, va: 0x%pK, pa: %pa, size: 0x%zx, type: %u\n",
qdss_mem[i].va, &qdss_mem[i].pa,
@ -2469,6 +2477,13 @@ static void wlfw_qdss_trace_req_mem_ind_cb(struct qmi_handle *qmi,
}
priv->qdss_mem_seg_len = ind_msg->mem_seg_len;
if (priv->qdss_mem_seg_len > QMI_WLFW_MAX_NUM_MEM_SEG) {
icnss_pr_err("Invalid seg len %u\n",
priv->qdss_mem_seg_len);
return;
}
for (i = 0; i < priv->qdss_mem_seg_len; i++) {
icnss_pr_dbg("QDSS requests for memory, size: 0x%x, type: %u\n",
ind_msg->mem_seg[i].size,