Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9492afea authored by Deven Patel's avatar Deven Patel
Browse files

drivers: soc: Fix possible APR null pointer dereference 



There's a possible null pointer deference if APR open fails.
Add the fix to handle error case cleanup gracefully.

CRs-fixed: 979283
Change-Id: I4c0cc05bf08d2eae5c27a1dba0a33f4183f81cf3
Signed-off-by: default avatarDeven Patel <cdevenp@codeaurora.org>
parent 676c9bc2

drivers/soc/qcom/qdsp6v2/apr_tal_glink.c

+9 −11
Original line number Diff line number Diff line
@@ -256,7 +256,7 @@ struct apr_svc_ch_dev *apr_tal_open(uint32_t clnt, uint32_t dest, uint32_t dl, 
	mutex_lock(&apr_ch->m_lock);

	if (apr_ch->handle) {

		pr_err("%s: This channel is already opened\n", __func__);

		apr_ch = NULL;

		rc = -EBUSY;

		goto unlock;

	}
@@ -299,30 +299,28 @@ struct apr_svc_ch_dev *apr_tal_open(uint32_t clnt, uint32_t dest, uint32_t dl, 
	if (rc == 0) {

		pr_err("%s: TIMEOUT for OPEN event\n", __func__);

		rc = -ETIMEDOUT;

		goto unlock;

		goto close_link;

	}



	rc = apr_tal_rx_intents_config(apr_ch, APR_DEFAULT_NUM_OF_INTENTS,

				       APR_MAX_BUF);

	if (rc) {

		pr_err("%s: Unable to queue intents\n", __func__);

		goto unlock;

		goto close_link;

	}



	apr_ch->func = func;

	apr_ch->priv = priv;



unlock:

	if (rc && apr_ch) {

		if (apr_ch->handle) {

close_link:

	if (rc) {

		glink_close(apr_ch->handle);

		apr_ch->handle = NULL;

	}

		apr_ch = NULL;

	}

unlock:

	mutex_unlock(&apr_ch->m_lock);



	return apr_ch;

	return rc ? NULL : apr_ch;

}



int apr_tal_close(struct apr_svc_ch_dev *apr_ch)