diff options
| author | Vipin Deep Kaur <vkaur@codeaurora.org> | 2019-08-05 12:15:36 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-09-05 22:10:54 -0700 |
| commit | 67dab0377ce1c02f6c76915daa9765f755b73daf (patch) | |
| tree | db2489e60a1068afc347711863d980ce3a8f58b1 | |
| parent | a2c5ca327b447828300e9ffde4b7fb0a81223957 (diff) | |
i2c-msm-v2: Add NULL pointer check on i2c messages
Add check in i2c driver to ensure the client passes valid messages
for i2c transfer.
Change-Id: I75ceee649d387e4324155c01d0c1e8a40342dff5
Signed-off-by: Vipin Deep Kaur <vkaur@codeaurora.org>
| -rw-r--r-- | drivers/i2c/busses/i2c-msm-v2.c | 17 |
1 files changed, 8 insertions, 9 deletions
diff --git a/drivers/i2c/busses/i2c-msm-v2.c b/drivers/i2c/busses/i2c-msm-v2.c index 198e55829226..870f69879237 100644 --- a/drivers/i2c/busses/i2c-msm-v2.c +++ b/drivers/i2c/busses/i2c-msm-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2155,8 +2155,12 @@ static bool i2c_msm_xfer_next_buf(struct i2c_msm_ctrl *ctrl) { struct i2c_msm_xfer_buf *cur_buf = &ctrl->xfer.cur_buf; struct i2c_msg *cur_msg = ctrl->xfer.msgs + cur_buf->msg_idx; - int bc_rem = cur_msg->len - cur_buf->end_idx; + int bc_rem = 0; + if (!cur_msg) + return false; + + bc_rem = cur_msg->len - cur_buf->end_idx; if (cur_buf->is_init && cur_buf->end_idx && bc_rem) { /* not the first buffer in a message */ @@ -2330,17 +2334,12 @@ i2c_msm_frmwrk_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) struct i2c_msm_ctrl *ctrl = i2c_get_adapdata(adap); struct i2c_msm_xfer *xfer = &ctrl->xfer; - if (num < 1) { + if (IS_ERR_OR_NULL(msgs) || num < 1) { dev_err(ctrl->dev, - "error on number of msgs(%d) received\n", num); + "Error on msgs Accessing invalid message pointer or message buffer\n"); return -EINVAL; } - if (IS_ERR_OR_NULL(msgs)) { - dev_err(ctrl->dev, " error on msgs Accessing invalid pointer location\n"); - return PTR_ERR(msgs); - } - /* if system is suspended just bail out */ if (ctrl->pwr_state == I2C_MSM_PM_SYS_SUSPENDED) { dev_err(ctrl->dev, |