Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6614eb6a authored by Karthikeyan Mani's avatar Karthikeyan Mani
Browse files

drivers: mfd: Check device id null pointer before dereferencing 



Check for null return value of slim_get_device_id(slim)
before dereferencing.

CRs-fixed: 1095395
Change-Id: Ie45dfca3b1bc5b9883c88f401f1a2af7a6d5a58d
Signed-off-by: default avatarKarthikeyan Mani <kmani@codeaurora.org>
parent 3c45c2a8

drivers/mfd/wcd9xxx-core.c

+20 −9
Original line number Diff line number Diff line
@@ -1214,11 +1214,19 @@ static int wcd9xxx_slim_probe(struct slim_device *slim) 
{

	struct wcd9xxx *wcd9xxx;

	struct wcd9xxx_pdata *pdata;

	const struct slim_device_id *device_id;

	int ret = 0;

	int intf_type;



	intf_type = wcd9xxx_get_intf_type();



	wcd9xxx = devm_kzalloc(&slim->dev, sizeof(struct wcd9xxx),

				GFP_KERNEL);

	if (!wcd9xxx) {

		ret = -ENOMEM;

		goto err;

	}



	if (!slim) {

		ret = -EINVAL;

		goto err;
@@ -1227,7 +1235,8 @@ static int wcd9xxx_slim_probe(struct slim_device *slim) 
	if (intf_type == WCD9XXX_INTERFACE_TYPE_I2C) {

		dev_dbg(&slim->dev, "%s:Codec is detected in I2C mode\n",

			__func__);

		return -ENODEV;

		ret = -ENODEV;

		goto err;

	}

	if (slim->dev.of_node) {

		dev_info(&slim->dev, "Platform data from device tree\n");
@@ -1261,21 +1270,22 @@ static int wcd9xxx_slim_probe(struct slim_device *slim) 
		goto err;

	}



	wcd9xxx = devm_kzalloc(&slim->dev, sizeof(struct wcd9xxx),

				GFP_KERNEL);

	if (!wcd9xxx) {

		ret = -ENOMEM;

		goto err;

	}

	if (!slim->ctrl) {

		dev_err(&slim->dev, "%s: Error, no SLIMBUS control data\n",

			__func__);

		ret = -EINVAL;

		goto err_codec;

	}

	wcd9xxx->type = slim_get_device_id(slim)->driver_data;

	device_id = slim_get_device_id(slim);

	if (!device_id) {

		dev_err(&slim->dev, "%s: Error, no device id\n", __func__);

		ret = -EINVAL;

		goto err;

	}



	wcd9xxx->type = device_id->driver_data;

	dev_info(&slim->dev, "%s: probing for wcd type: %d, name: %s\n",

		 __func__, wcd9xxx->type, slim_get_device_id(slim)->name);

		 __func__, wcd9xxx->type, device_id->name);



	/* wcd9xxx members init */

	wcd9xxx->multi_reg_write = wcd9xxx_slim_multi_reg_write;
@@ -1416,6 +1426,7 @@ err_supplies: 
err_codec:

	slim_set_clientdata(slim, NULL);

err:

	devm_kfree(&slim->dev, wcd9xxx);

	return ret;

}

static int wcd9xxx_slim_remove(struct slim_device *pdev)