Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e6707683 authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

diag: Place proper NULL pointer checks 



This patch checks the buffer for NULL
pointer to prevent undefined access.

CRs-Fixed: 2032374
Change-Id: I1a1c4ca24e5c3d538ea93685de304dd186968308
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 4901c7fc

drivers/char/diag/diagfwd_peripheral.c

+42 −35
Original line number Diff line number Diff line
@@ -1295,8 +1295,7 @@ static void diagfwd_queue_read(struct diagfwd_info *fwd_info) 


void diagfwd_buffers_init(struct diagfwd_info *fwd_info)

{

	unsigned char *temp_buf;

	uint8_t peripheral;

	unsigned char *temp_buf = NULL;



	if (!fwd_info)

		return;
@@ -1309,20 +1308,19 @@ void diagfwd_buffers_init(struct diagfwd_info *fwd_info) 


	mutex_lock(&fwd_info->buf_mutex);



	peripheral = fwd_info->peripheral;



	if (!fwd_info->buf_1) {

		fwd_info->buf_1 = kzalloc(sizeof(struct diagfwd_buf_t),

					  GFP_KERNEL);

		if (!fwd_info->buf_1)

		if (ZERO_OR_NULL_PTR(fwd_info->buf_1))

			goto err;

		kmemleak_not_leak(fwd_info->buf_1);

	}



	if (!fwd_info->buf_1->data) {

		fwd_info->buf_1->data = kzalloc(PERIPHERAL_BUF_SZ +

					APF_DIAG_PADDING,

					GFP_KERNEL);

		if (!fwd_info->buf_1->data)

		if (ZERO_OR_NULL_PTR(fwd_info->buf_1->data))

			goto err;

		fwd_info->buf_1->len = PERIPHERAL_BUF_SZ;

		kmemleak_not_leak(fwd_info->buf_1->data);
@@ -1334,7 +1332,7 @@ void diagfwd_buffers_init(struct diagfwd_info *fwd_info) 
		if (!fwd_info->buf_2) {

			fwd_info->buf_2 = kzalloc(sizeof(struct diagfwd_buf_t),

					      GFP_KERNEL);

			if (!fwd_info->buf_2)

			if (ZERO_OR_NULL_PTR(fwd_info->buf_2))

				goto err;

			kmemleak_not_leak(fwd_info->buf_2);

		}
@@ -1343,7 +1341,7 @@ void diagfwd_buffers_init(struct diagfwd_info *fwd_info) 
			fwd_info->buf_2->data = kzalloc(PERIPHERAL_BUF_SZ +

							APF_DIAG_PADDING,

						    GFP_KERNEL);

			if (!fwd_info->buf_2->data)

			if (ZERO_OR_NULL_PTR(fwd_info->buf_2->data))

				goto err;

			fwd_info->buf_2->len = PERIPHERAL_BUF_SZ;

			kmemleak_not_leak(fwd_info->buf_2->data);
@@ -1352,49 +1350,53 @@ void diagfwd_buffers_init(struct diagfwd_info *fwd_info) 
							fwd_info->type, 2);

		}



		if (driver->feature[peripheral].untag_header &&

			driver->peripheral_untag[peripheral]) {

		if (driver->feature[fwd_info->peripheral].untag_header) {

			if (!fwd_info->buf_upd_1_a) {

				fwd_info->buf_upd_1_a =

					kzalloc(sizeof(struct diagfwd_buf_t),

						      GFP_KERNEL);

				if (!fwd_info->buf_upd_1_a)

				if (ZERO_OR_NULL_PTR(fwd_info->buf_upd_1_a))

					goto err;

				kmemleak_not_leak(fwd_info->buf_upd_1_a);

			}



			if (!fwd_info->buf_upd_1_a->data) {

			if (fwd_info->buf_upd_1_a &&

				!fwd_info->buf_upd_1_a->data) {

				fwd_info->buf_upd_1_a->data =

					kzalloc(PERIPHERAL_BUF_SZ +

						APF_DIAG_PADDING,

					    GFP_KERNEL);

				if (!fwd_info->buf_upd_1_a->data)

				temp_buf = fwd_info->buf_upd_1_a->data;

				if (ZERO_OR_NULL_PTR(temp_buf))

					goto err;

				fwd_info->buf_upd_1_a->len = PERIPHERAL_BUF_SZ;

				kmemleak_not_leak(fwd_info->buf_upd_1_a->data);

				kmemleak_not_leak(temp_buf);

				fwd_info->buf_upd_1_a->ctxt = SET_BUF_CTXT(

					fwd_info->peripheral,

					fwd_info->type, 3);

			}



			if (!fwd_info->buf_upd_1_b) {

				fwd_info->buf_upd_1_b =

				kzalloc(sizeof(struct diagfwd_buf_t),

					      GFP_KERNEL);

			if (!fwd_info->buf_upd_1_b)

				if (ZERO_OR_NULL_PTR(fwd_info->buf_upd_1_b))

					goto err;

				kmemleak_not_leak(fwd_info->buf_upd_1_b);

			}



			if (!fwd_info->buf_upd_1_b->data) {

			if (fwd_info->buf_upd_1_b &&

				!fwd_info->buf_upd_1_b->data) {

				fwd_info->buf_upd_1_b->data =

					kzalloc(PERIPHERAL_BUF_SZ +

						APF_DIAG_PADDING,

						GFP_KERNEL);

				if (!fwd_info->buf_upd_1_b->data)

				temp_buf = fwd_info->buf_upd_1_b->data;

				if (ZERO_OR_NULL_PTR(temp_buf))

					goto err;

				fwd_info->buf_upd_1_b->len =

					PERIPHERAL_BUF_SZ;

				kmemleak_not_leak(fwd_info->buf_upd_1_b->data);

				kmemleak_not_leak(temp_buf);

				fwd_info->buf_upd_1_b->ctxt = SET_BUF_CTXT(

					fwd_info->peripheral,

					fwd_info->type, 4);
@@ -1408,51 +1410,56 @@ void diagfwd_buffers_init(struct diagfwd_info *fwd_info) 
					kzalloc(PERIPHERAL_BUF_SZ +

						APF_DIAG_PADDING,

						GFP_KERNEL);

				if (!fwd_info->buf_1->data_raw)

				temp_buf = fwd_info->buf_1->data_raw;

				if (ZERO_OR_NULL_PTR(temp_buf))

					goto err;

				fwd_info->buf_1->len_raw =

					PERIPHERAL_BUF_SZ;

				kmemleak_not_leak(fwd_info->buf_1->data_raw);

				kmemleak_not_leak(temp_buf);

			}



			if (!fwd_info->buf_2->data_raw) {

				fwd_info->buf_2->data_raw =

					kzalloc(PERIPHERAL_BUF_SZ +

						APF_DIAG_PADDING,

						GFP_KERNEL);

				if (!fwd_info->buf_2->data_raw)

				temp_buf = fwd_info->buf_2->data_raw;

				if (ZERO_OR_NULL_PTR(temp_buf))

					goto err;

				fwd_info->buf_2->len_raw =

					PERIPHERAL_BUF_SZ;

				kmemleak_not_leak(fwd_info->buf_2->data_raw);

				kmemleak_not_leak(temp_buf);

			}



			if (driver->feature[fwd_info->peripheral].

					untag_header &&

				driver->peripheral_untag[peripheral]) {

				if (!fwd_info->buf_upd_1_a->data_raw) {

				untag_header) {

				if (fwd_info->buf_upd_1_a &&

					!fwd_info->buf_upd_1_a->data_raw) {

					fwd_info->buf_upd_1_a->data_raw =

						kzalloc(PERIPHERAL_BUF_SZ +

							APF_DIAG_PADDING,

							GFP_KERNEL);

					if (!fwd_info->buf_upd_1_a->data_raw)

					temp_buf =

						fwd_info->buf_upd_1_a->data_raw;

					if (ZERO_OR_NULL_PTR(temp_buf))

						goto err;

					fwd_info->buf_upd_1_a->len_raw =

						PERIPHERAL_BUF_SZ;

					temp_buf =

						fwd_info->buf_upd_1_a->data_raw;

					kmemleak_not_leak(temp_buf);

				}

				if (!fwd_info->buf_upd_1_b->data_raw) {



				if (fwd_info->buf_upd_1_b &&

					!fwd_info->buf_upd_1_b->data_raw) {

					fwd_info->buf_upd_1_b->data_raw =

						kzalloc(PERIPHERAL_BUF_SZ +

							APF_DIAG_PADDING,

							GFP_KERNEL);

					if (!fwd_info->buf_upd_1_b->data_raw)

					temp_buf =

						fwd_info->buf_upd_1_b->data_raw;

					if (ZERO_OR_NULL_PTR(temp_buf))

						goto err;

					fwd_info->buf_upd_1_b->len_raw =

						PERIPHERAL_BUF_SZ;

					temp_buf =

						fwd_info->buf_upd_1_b->data_raw;

					kmemleak_not_leak(temp_buf);

				}

			}