Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8c1c5f57 authored by Karthikeyan Ramasubramanian's avatar Karthikeyan Ramasubramanian
Browse files

slimbus: Fix multiple corner cases 



Initialize the variable before accessing it. Also ensure that it does
not get used outside its intended scope.

Always check for the validity of a pointer before accessing it.

CRs-Fixed: 2121178
Change-Id: I08fdb1bf8445ac9d321eb3433c6a935f34bae437
Signed-off-by: default avatarKarthikeyan Ramasubramanian <kramasub@codeaurora.org>
parent e13b7564

drivers/slimbus/slim-msm-ngd.c

+9 −1
Original line number Diff line number Diff line
@@ -422,9 +422,11 @@ static int ngd_xfer_msg(struct slim_controller *ctrl, struct slim_msg_txn *txn) 
	u8 txn_mt;

	u16 txn_mc = txn->mc;

	u8 wbuf[SLIM_MSGQ_BUF_LEN];

	const u8 *old_wbuf = NULL;

	bool report_sat = false;

	bool sync_wr = true;



	memset(wbuf, 0, sizeof(wbuf));

	if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)

		return -EPROTONOSUPPORT;
@@ -590,6 +592,7 @@ static int ngd_xfer_msg(struct slim_controller *ctrl, struct slim_msg_txn *txn) 
			goto ngd_xfer_err;

		}

		txn->len = i;

		old_wbuf = txn->wbuf;

		txn->wbuf = wbuf;

		txn->rl = txn->len + 4;

	}
@@ -758,13 +761,18 @@ static int ngd_xfer_msg(struct slim_controller *ctrl, struct slim_msg_txn *txn) 
			ctrl->txnt[txn->tid] = NULL;

			spin_unlock_irqrestore(&ctrl->txn_lock, flags);

		}

		return ret ? ret : dev->err;

		goto ngd_xfer_ret;

	}

ngd_xfer_err:

	if (!report_sat) {

		mutex_unlock(&dev->tx_lock);

		msm_slim_put_ctrl(dev);

	}

ngd_xfer_ret:

	if (txn->wbuf == wbuf)

		txn->wbuf = old_wbuf;

	if (txn->comp == &done)

		txn->comp = NULL;

	return ret ? ret : dev->err;

}

drivers/slimbus/slimbus.c

+1 −1
Original line number Diff line number Diff line
@@ -2512,7 +2512,7 @@ static int slim_sched_chans(struct slim_device *sb, u32 clkgear, 
				}

			}

			/* schedule 4k family channels */

			while (coeff1 < ctrl->sched.num_cc1 &&

			while (coeff1 < ctrl->sched.num_cc1 && slc1 &&

				curexp == (int)slc1->rootexp + expshft) {

				/* searchorder effective when opensl valid */

				static const int srcho[] = { 5, 2, 4, 1, 3, 0 };