From 82e91e05410803ff20955ea564ed184009a09429 Mon Sep 17 00:00:00 2001
From: Will Huang <wilhuang@codeaurora.org>
Date: Mon, 26 Jun 2017 10:55:16 +0800
Subject: [PATCH] qcacmn: Check pointer tbuffer always before access it

Pointer tbuffer is allocated from heap or get from other module, it
is checked in some if branch but not every possible NULL branch.

Adding NULL check of tbuffer in every possible branch.

Change-Id: Id3c9f941623995ff73a993e29c53f3b9ce66f10e
CRs-Fixed: 2064350
---
 hif/src/sdio/native_sdio/src/hif.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/hif/src/sdio/native_sdio/src/hif.c b/hif/src/sdio/native_sdio/src/hif.c
index 38332c2d46d5..f834840049ae 100644
--- a/hif/src/sdio/native_sdio/src/hif.c
+++ b/hif/src/sdio/native_sdio/src/hif.c
@@ -339,7 +339,7 @@ __hif_read_write(struct hif_sdio_dev *device,
 {
 	uint8_t opcode;
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
-	int ret;
+	int ret = A_OK;
 	uint8_t *tbuffer;
 	bool bounced = false;
 
@@ -484,7 +484,7 @@ __hif_read_write(struct hif_sdio_dev *device,
 					("%s: writesb ret=%d address: 0x%X, len: %d, 0x%X\n",
 					 __func__, ret, address, length,
 					 *(int *)tbuffer));
-			} else {
+			} else if (tbuffer) {
 				ret =
 					sdio_memcpy_toio(device->func, address,
 							 tbuffer, length);
@@ -522,7 +522,7 @@ __hif_read_write(struct hif_sdio_dev *device,
 					("%s: readsb ret=%d address: 0x%X, len: %d, 0x%X\n",
 					 __func__, ret, address, length,
 					 *(int *)tbuffer));
-			} else {
+			} else if (tbuffer) {
 				ret =
 					sdio_memcpy_fromio(device->func,
 							   tbuffer,
@@ -533,7 +533,7 @@ __hif_read_write(struct hif_sdio_dev *device,
 					 *(int *)tbuffer));
 			}
 #if HIF_USE_DMA_BOUNCE_BUFFER
-			if (bounced)
+			if (bounced && tbuffer)
 				memcpy(buffer, tbuffer, length);
 #endif
 		} else {
@@ -541,7 +541,7 @@ __hif_read_write(struct hif_sdio_dev *device,
 					("%s: Invalid direction: 0x%08x\n",
 					 __func__, request));
 			status = QDF_STATUS_E_INVAL;
-			break;
+			return status;
 		}
 
 		if (ret) {
@@ -2388,6 +2388,10 @@ int hif_device_resume(struct device *dev)
 	struct hif_sdio_dev *device;
 
 	device = get_hif_device(func);
+	if (!device) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("get hif device failed\n"));
+		return QDF_STATUS_E_FAILURE;
+	}
 
 	if (device->device_state == HIF_DEVICE_STATE_CUTPOWER) {
 		config = HIF_DEVICE_POWER_UP;
@@ -2419,7 +2423,7 @@ int hif_device_resume(struct device *dev)
 	AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
 			("%s: +hif_device_resume\n",
 			 __func__));
-	if (device && device->claimed_ctx
+	if (device->claimed_ctx
 	    && osdrv_callbacks.device_suspend_handler) {
 		status =
 		osdrv_callbacks.device_resume_handler(device->claimed_ctx);
@@ -2543,9 +2547,18 @@ static struct hif_sdio_dev *add_hif_device(struct sdio_func *func)
 	hifdevice = (struct hif_sdio_dev *) qdf_mem_malloc(sizeof(
 							struct hif_sdio_dev));
 	AR_DEBUG_ASSERT(hifdevice != NULL);
+	if (hifdevice == NULL) {
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Alloc hif device fail\n"));
+		return NULL;
+	}
 #if HIF_USE_DMA_BOUNCE_BUFFER
 	hifdevice->dma_buffer = qdf_mem_malloc(HIF_DMA_BUFFER_SIZE);
 	AR_DEBUG_ASSERT(hifdevice->dma_buffer != NULL);
+	if (hifdevice->dma_buffer == NULL) {
+		qdf_mem_free(hifdevice);
+		AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Alloc dma buffer fail\n"));
+		return NULL;
+	}
 #endif
 	hifdevice->func = func;
 	hifdevice->power_config = HIF_DEVICE_POWER_UP;