Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c1414a0 authored by Saket Saurabh's avatar Saket Saurabh
Browse files

msm: usb_bam: Add Null check in connect_pipe() 



Pointer returned from call to function dma_alloc_coherent() and
ioremap() may be NULL.
Hence add NULL check to prevent NULL pointer dereference.

Change-Id: I4b3239388ac5d7dd4affbd7db0c38f2a790fce2a
Signed-off-by: default avatarSaket Saurabh <ssaurabh@codeaurora.org>
parent 763e35c9

drivers/platform/msm/usb_bam.c

+35 −0
Original line number Diff line number Diff line
@@ -438,6 +438,11 @@ static int connect_pipe(u8 idx, u32 *usb_pipe_idx) 
		data_buf->size = pipe_connect->data_fifo_size;

		data_buf->base =

			ioremap(data_buf->phys_base, data_buf->size);

		if (!data_buf->base) {

			pr_err("%s: ioremap failed for data fifo\n", __func__);

			ret = -ENOMEM;

			goto disable_memclk;

		}

		memset(data_buf->base, 0, data_buf->size);



		desc_buf->phys_base =
@@ -446,6 +451,13 @@ static int connect_pipe(u8 idx, u32 *usb_pipe_idx) 
		desc_buf->size = pipe_connect->desc_fifo_size;

		desc_buf->base =

			ioremap(desc_buf->phys_base, desc_buf->size);

		if (!desc_buf->base) {

			pr_err("%s: ioremap failed for descriptor fifo\n",

								__func__);

			iounmap(data_buf->base);

			ret = -ENOMEM;

			goto disable_memclk;

		}

		memset(desc_buf->base, 0, desc_buf->size);

		break;

	case SYSTEM_MEM:
@@ -457,6 +469,12 @@ static int connect_pipe(u8 idx, u32 *usb_pipe_idx) 
			pipe_connect->data_fifo_size,

			&(data_buf->phys_base),

			0);

		if (!data_buf->base) {

			pr_err("%s: dma_alloc_coherent failed for data fifo\n",

								__func__);

			ret = -ENOMEM;

			goto disable_memclk;

		}

		memset(data_buf->base, 0, pipe_connect->data_fifo_size);



		desc_buf->size = pipe_connect->desc_fifo_size;
@@ -465,6 +483,15 @@ static int connect_pipe(u8 idx, u32 *usb_pipe_idx) 
			pipe_connect->desc_fifo_size,

			&(desc_buf->phys_base),

			0);

		if (!desc_buf->base) {

			pr_err("%s: dma_alloc_coherent failed for desc fifo\n",

								__func__);

			dma_free_coherent(&ctx.usb_bam_pdev->dev,

			pipe_connect->data_fifo_size, data_buf->base,

			data_buf->phys_base);

			ret = -ENOMEM;

			goto disable_memclk;

		}

		memset(desc_buf->base, 0, pipe_connect->desc_fifo_size);

		break;

	default:
@@ -487,6 +514,14 @@ static int connect_pipe(u8 idx, u32 *usb_pipe_idx) 


error:

	sps_disconnect(*pipe);

disable_memclk:

	if (pipe_connect->mem_type == USB_PRIVATE_MEM) {

		writel_relaxed(0x0, ctx.qscratch_ram1_reg);

		writel_relaxed(0x0, ctx.qscratch_ram1_reg +

					QSCRATCH_CGCTL_REG_OFFSET);

		clk_disable_unprepare(ctx.mem_clk);

		clk_disable_unprepare(ctx.mem_iface_clk);

	}

free_sps_endpoint:

	sps_free_endpoint(*pipe);

	return ret;