Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2d50ef2c authored by Jack Pham's avatar Jack Pham
Browse files

usb: pd: Avoid potential NULL ptr dereferences 



Check that a valid pointer was passed in addition to non-zero
length to avoid dereferencing NULL pointers in functions
where data is copied from policy engine to the PD PHY.

Issues were identified with static analysis tool.

Change-Id: Ib42aad9e0d838eda4653e0bab9f074b3031983dd
Signed-off-by: default avatarJack Pham <jackp@codeaurora.org>
parent c6855ffd

drivers/usb/pd/policy_engine.c

+2 −1
Original line number Diff line number Diff line
@@ -925,6 +925,7 @@ int usbpd_send_vdm(struct usbpd *pd, u32 vdm_hdr, const u32 *vdos, int num_vdos) 
		return -ENOMEM;



	vdm_tx->data[0] = vdm_hdr;

	if (vdos && num_vdos)

		memcpy(&vdm_tx->data[1], vdos, num_vdos * sizeof(u32));

	vdm_tx->size = num_vdos + 1; /* include the header */

drivers/usb/pd/qpnp-pdphy.c

+5 −3
Original line number Diff line number Diff line
@@ -445,6 +445,8 @@ int pd_phy_write(u16 hdr, const u8 *data, size_t data_len, 


	dev_dbg(pdphy->dev, "%s: hdr %x frame type %d timeout %u\n",

			__func__, hdr, type, timeout_ms);



	if (data && data_len)

		print_hex_dump_debug("tx data obj:", DUMP_PREFIX_NONE, 32, 4,

				data, data_len, false);
@@ -472,7 +474,7 @@ int pd_phy_write(u16 hdr, const u8 *data, size_t data_len, 
	if (ret)

		return ret;



	if (data_len) {

	if (data && data_len) {

		/* write data objects of SOP message */

		ret = pdphy_bulk_reg_write(pdphy, USB_PDPHY_TX_BUFFER_DATA,

				data, data_len);