Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8653be1a authored by Ilya Yanok's avatar Ilya Yanok Committed by Samuel Ortiz
Browse files

mfd: Fix twl-core oops while calling twl_i2c_* for unbound driver 



Check inuse variable before trying to access twl_map to prevent
dereferencing of uninitialized variable.

Signed-off-by: default avatarIlya Yanok <yanok@emcraft.com>
Cc: stable@kernel.org
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
parent 858a6303

drivers/mfd/twl-core.c

+8 −8
Original line number Original line Diff line number Diff line
@@ -363,13 +363,13 @@ int twl_i2c_write(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes) 
		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);

		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);

		return -EPERM;

		return -EPERM;

	}

	}

	sid = twl_map[mod_no].sid;

	twl = &twl_modules[sid];



	if (unlikely(!inuse)) {

	if (unlikely(!inuse)) {

		pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);

		pr_err("%s: not initialized\n", DRIVER_NAME);

		return -EPERM;

		return -EPERM;

	}

	}

	sid = twl_map[mod_no].sid;

	twl = &twl_modules[sid];



	mutex_lock(&twl->xfer_lock);

	mutex_lock(&twl->xfer_lock);

	/*

	/*

	 * [MSG1]: fill the register address data

	 * [MSG1]: fill the register address data
@@ -420,13 +420,13 @@ int twl_i2c_read(u8 mod_no, u8 *value, u8 reg, unsigned num_bytes) 
		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);

		pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);

		return -EPERM;

		return -EPERM;

	}

	}

	sid = twl_map[mod_no].sid;

	twl = &twl_modules[sid];



	if (unlikely(!inuse)) {

	if (unlikely(!inuse)) {

		pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);

		pr_err("%s: not initialized\n", DRIVER_NAME);

		return -EPERM;

		return -EPERM;

	}

	}

	sid = twl_map[mod_no].sid;

	twl = &twl_modules[sid];



	mutex_lock(&twl->xfer_lock);

	mutex_lock(&twl->xfer_lock);

	/* [MSG1] fill the register address data */

	/* [MSG1] fill the register address data */

	msg = &twl->xfer_msg[0];

	msg = &twl->xfer_msg[0];