Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7ade8b5 authored by Shantanu Jain's avatar Shantanu Jain
Browse files

input: synaptics_dsx_2.6: fix issues raised by static analyzer 



Fix issues raised by static analyzer:
1. initialize "retval" before being returned from the driver function.
2. Check return value of the function create_singlethread_workqueue()
   and return -ENOMEM if it failed. If creation of the workqueue
   failed, then both queue_work() and queue_delayed_work() calls will
   later crash, as they expect the workqueue pointer to be a non-NULL
   value. Also add clean-up code for this.
3. check return value of the snprintf() call as array 'buf' of size
   16 may use index value(s) 16...20.

CRs-Fixed: 995687
Change-Id: I89d9f7cacbcf23de43a7e96556d1ac65911126d6
Signed-off-by: default avatarShantanu Jain <shjain@codeaurora.org>
parent 2741ea71

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_core.c

+29 −4
Original line number Diff line number Diff line
@@ -3139,7 +3139,9 @@ static int synaptics_rmi4_gpio_setup(int gpio, bool config, int dir, int state) 
	unsigned char buf[16];



	if (config) {

		snprintf(buf, PAGE_SIZE, "dsx_gpio_%u\n", gpio);

		retval = snprintf(buf, ARRAY_SIZE(buf), "dsx_gpio_%u\n", gpio);

		if (retval >= 16)

			return -EINVAL;



		retval = gpio_request(gpio, buf);

		if (retval) {
@@ -4077,19 +4079,29 @@ static int synaptics_rmi4_probe(struct platform_device *pdev) 


	rmi4_data->rb_workqueue =

			create_singlethread_workqueue("dsx_rebuild_workqueue");

	if (!rmi4_data->rb_workqueue) {

		retval = -ENOMEM;

		goto err_rb_workqueue;

	}

	INIT_DELAYED_WORK(&rmi4_data->rb_work, synaptics_rmi4_rebuild_work);



	exp_data.workqueue = create_singlethread_workqueue("dsx_exp_workqueue");

	if (!exp_data.workqueue) {

		retval = -ENOMEM;

		goto err_exp_data_workqueue;

	}

	INIT_DELAYED_WORK(&exp_data.work, synaptics_rmi4_exp_fn_work);

	exp_data.rmi4_data = rmi4_data;

	exp_data.queue_work = true;

	queue_delayed_work(exp_data.workqueue,

			&exp_data.work,

			0);

	queue_delayed_work(exp_data.workqueue, &exp_data.work, 0);



#ifdef FB_READY_RESET

	rmi4_data->reset_workqueue =

			create_singlethread_workqueue("dsx_reset_workqueue");

	if (!rmi4_data->reset_workqueue) {

		retval = -ENOMEM;

		goto err_reset_workqueue;

	}

	INIT_WORK(&rmi4_data->reset_work, synaptics_rmi4_reset_work);

	queue_work(rmi4_data->reset_workqueue, &rmi4_data->reset_work);

#endif
@@ -4100,6 +4112,19 @@ static int synaptics_rmi4_probe(struct platform_device *pdev) 


	return retval;



#ifdef FB_READY_RESET

err_reset_workqueue:

#endif

	cancel_delayed_work_sync(&exp_data.work);

	flush_workqueue(exp_data.workqueue);

	destroy_workqueue(exp_data.workqueue);



err_exp_data_workqueue:

	cancel_delayed_work_sync(&rmi4_data->rb_work);

	flush_workqueue(rmi4_data->rb_workqueue);

	destroy_workqueue(rmi4_data->rb_workqueue);



err_rb_workqueue:

err_sysfs:

	for (attr_count--; attr_count >= 0; attr_count--) {

		sysfs_remove_file(&rmi4_data->input_dev->dev.kobj,

drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c

+1 −1
Original line number Diff line number Diff line
@@ -288,7 +288,7 @@ static void synaptics_rmi4_i2c_check_addr(struct synaptics_rmi4_data *rmi4_data, 
static int synaptics_rmi4_i2c_set_page(struct synaptics_rmi4_data *rmi4_data,

		unsigned short addr)

{

	int retval;

	int retval = 0;

	unsigned char retry;

	unsigned char buf[PAGE_SELECT_LEN];

	unsigned char page;