Merge "msm: camera: Handle null pointer dereferences" (92a2e35f) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_dev.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -196,6 +196,11 @@ static int msm_jpeg_init_dev(struct platform_device *pdev)
		msm_jpeg_device_p->pdev = pdev;

		device_id = of_match_device(msm_jpeg_dt_match, &pdev->dev);
		if (!device_id) {
		JPEG_PR_ERR("%s: device_id is NULL\n", __func__);
		goto fail;
		}

		priv_data = device_id->data;
		msm_jpeg_device_p->core_type = priv_data->core_type;

+10 −0

Original line number	Diff line number	Diff line
		@@ -689,6 +689,11 @@ static int msm_vpe_notify_frame_done(struct vpe_device *vpe_dev)

		if (queue->len > 0) {
		frame_qcmd = msm_dequeue(queue, list_frame);
		if (!frame_qcmd) {
		pr_err("%s: %d frame_qcmd is NULL\n",
		__func__ , __LINE__);
		return -EINVAL;
		}
		processed_frame = frame_qcmd->command;
		do_gettimeofday(&(processed_frame->out_time));
		kfree(frame_qcmd);
		@@ -1366,6 +1371,11 @@ static long msm_vpe_subdev_ioctl(struct v4l2_subdev *sd,
		struct msm_vpe_frame_info_t *process_frame;
		VPE_DBG("VIDIOC_MSM_VPE_GET_EVENTPAYLOAD\n");
		event_qcmd = msm_dequeue(queue, list_eventdata);
		if (!event_qcmd) {
		pr_err("%s: %d event_qcmd is NULL\n",
		__func__ , __LINE__);
		return -EINVAL;
		}
		process_frame = event_qcmd->command;
		VPE_DBG("fid %d\n", process_frame->frame_id);
		if (copy_to_user((void __user *)ioctl_ptr->ioctl_ptr,

+0 −2

Original line number	Diff line number	Diff line
		@@ -178,8 +178,6 @@ static irqreturn_t msm_csid_irq(int irq_num, void *data)
		{
		uint32_t irq;
		struct csid_device *csid_dev = data;
		void __iomem *csidbase;
		csidbase = csid_dev->base;

		if (!csid_dev) {
		pr_err("%s:%d csid_dev NULL\n", __func__, __LINE__);

+4 −0

Original line number	Diff line number	Diff line
		@@ -612,6 +612,10 @@ static int msm_eeprom_get_dt_data(struct msm_eeprom_ctrl_t *e_ctrl)
		else if (e_ctrl->eeprom_device_type == MSM_CAMERA_PLATFORM_DEVICE)
		of_node = e_ctrl->pdev->dev.of_node;

		if (!of_node) {
		pr_err("%s: %d of_node is NULL\n", __func__ , __LINE__);
		return -ENOMEM;
		}
		rc = msm_camera_get_dt_vreg_data(of_node, &power_info->cam_vreg,
		&power_info->num_vreg);
		if (rc < 0)

+7 −6

Original line number	Diff line number	Diff line
		@@ -151,13 +151,13 @@ int msm_flash_led_release(struct msm_led_flash_ctrl_t *fctrl)
		struct msm_camera_sensor_board_info *flashdata = NULL;
		struct msm_camera_power_ctrl_t *power_info = NULL;

		flashdata = fctrl->flashdata;
		power_info = &flashdata->power_info;
		CDBG("%s:%d called\n", __func__, __LINE__);
		if (!fctrl) {
		pr_err("%s:%d fctrl NULL\n", __func__, __LINE__);
		return -EINVAL;
		}
		flashdata = fctrl->flashdata;
		power_info = &flashdata->power_info;
		CDBG("%s:%d called\n", __func__, __LINE__);
		gpio_set_value_cansleep(
		power_info->gpio_conf->gpio_num_info->
		gpio_num[SENSOR_GPIO_FL_EN],
		@@ -190,13 +190,13 @@ int msm_flash_led_off(struct msm_led_flash_ctrl_t *fctrl)
		struct msm_camera_sensor_board_info *flashdata = NULL;
		struct msm_camera_power_ctrl_t *power_info = NULL;

		flashdata = fctrl->flashdata;
		power_info = &flashdata->power_info;
		CDBG("%s:%d called\n", __func__, __LINE__);
		if (!fctrl) {
		pr_err("%s:%d fctrl NULL\n", __func__, __LINE__);
		return -EINVAL;
		}
		flashdata = fctrl->flashdata;
		power_info = &flashdata->power_info;
		CDBG("%s:%d called\n", __func__, __LINE__);
		if (fctrl->flash_i2c_client && fctrl->reg_setting) {
		rc = fctrl->flash_i2c_client->i2c_func_tbl->i2c_write_table(
		fctrl->flash_i2c_client,
		@@ -652,6 +652,7 @@ int msm_flash_probe(struct platform_device *pdev,
		pr_err("%s flash_i2c_client NULL\n",
		__func__);
		rc = -EFAULT;
		goto probe_failure;
		}

		fctrl->flash_i2c_client->cci_client = kzalloc(sizeof(