Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 550d642f authored by Vijay Patil's avatar Vijay Patil
Browse files

icnss2: Add Null check before dereferencing variables 



Add Null check before dereferencing dev for set FW log mode,
force wake request & force wake response. Add ERR_OR_NULL check
for wpss load API gets called for wpss subsystem. Check for qdss
memory segment length.

Change-Id: Id4a43fa9ae332faa7f5741f338d985db8272d17a
Signed-off-by: default avatarVijay Patil <vijaylil@codeaurora.org>
parent 0d384b92

drivers/soc/qcom/icnss2/main.c

+15 −4
Original line number Diff line number Diff line
@@ -2713,11 +2713,18 @@ EXPORT_SYMBOL(icnss_get_mhi_state); 
int icnss_set_fw_log_mode(struct device *dev, uint8_t fw_log_mode)

{

	int ret;

	struct icnss_priv *priv = dev_get_drvdata(dev);

	struct icnss_priv *priv;



	if (!dev)

		return -ENODEV;



	priv = dev_get_drvdata(dev);



	if (!priv) {

		icnss_pr_err("Platform driver not initialized\n");

		return -EINVAL;

	}



	if (test_bit(ICNSS_FW_DOWN, &penv->state) ||

	    !test_bit(ICNSS_FW_READY, &penv->state)) {

		icnss_pr_err("FW down, ignoring fw_log_mode state: 0x%lx\n",
@@ -2737,11 +2744,13 @@ EXPORT_SYMBOL(icnss_set_fw_log_mode); 


int icnss_force_wake_request(struct device *dev)

{

	struct icnss_priv *priv = dev_get_drvdata(dev);

	struct icnss_priv *priv;



	if (!dev)

		return -ENODEV;



	priv = dev_get_drvdata(dev);



	if (!priv) {

		icnss_pr_err("Platform driver not initialized\n");

		return -EINVAL;
@@ -2764,11 +2773,13 @@ EXPORT_SYMBOL(icnss_force_wake_request); 


int icnss_force_wake_release(struct device *dev)

{

	struct icnss_priv *priv = dev_get_drvdata(dev);

	struct icnss_priv *priv;



	if (!dev)

		return -ENODEV;



	priv = dev_get_drvdata(dev);



	if (!priv) {

		icnss_pr_err("Platform driver not initialized\n");

		return -EINVAL;
@@ -3336,7 +3347,7 @@ static void icnss_wpss_load(struct work_struct *wpss_load_work) 
	struct icnss_priv *priv = icnss_get_plat_priv();



	priv->subsys = subsystem_get("wpss");

	if (IS_ERR(priv->subsys))

	if (IS_ERR_OR_NULL(priv->subsys))

		icnss_pr_err("Failed to load wpss subsys");

}

drivers/soc/qcom/icnss2/qmi.c

+15 −0
Original line number Diff line number Diff line
@@ -2078,6 +2078,14 @@ int wlfw_qdss_trace_mem_info_send_sync(struct icnss_priv *priv) 
	}



	req->mem_seg_len = priv->qdss_mem_seg_len;



	if (priv->qdss_mem_seg_len > QMI_WLFW_MAX_NUM_MEM_SEG) {

		icnss_pr_err("Invalid seg len %u\n",

			     priv->qdss_mem_seg_len);

		ret = -EINVAL;

		goto out;

	}



	for (i = 0; i < req->mem_seg_len; i++) {

		icnss_pr_dbg("Memory for FW, va: 0x%pK, pa: %pa, size: 0x%zx, type: %u\n",

			     qdss_mem[i].va, &qdss_mem[i].pa,
@@ -2469,6 +2477,13 @@ static void wlfw_qdss_trace_req_mem_ind_cb(struct qmi_handle *qmi, 
	}



	priv->qdss_mem_seg_len = ind_msg->mem_seg_len;



	if (priv->qdss_mem_seg_len > QMI_WLFW_MAX_NUM_MEM_SEG) {

		icnss_pr_err("Invalid seg len %u\n",

			     priv->qdss_mem_seg_len);

		return;

	}



	for (i = 0; i < priv->qdss_mem_seg_len; i++) {

		icnss_pr_dbg("QDSS requests for memory, size: 0x%x, type: %u\n",

			     ind_msg->mem_seg[i].size,