evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: pd: Avoid potential NULL ptr dereferences

Browse source 
Check that a valid pointer was passed in addition to non-zero
length to avoid dereferencing NULL pointers in functions
where data is copied from policy engine to the PD PHY.

Issues were identified with static analysis tool.

Change-Id: Ib42aad9e0d838eda4653e0bab9f074b3031983dd
Signed-off-by: Jack Pham <jackp@codeaurora.org>
This commit is contained in:
Jack Pham 2016-09-13 10:17:25 -07:00
parent c6855ffd7f
commit 2d50ef2cf3
2 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/usb/pd/policy_engine.c
View file

@ -925,7 +925,8 @@ int usbpd_send_vdm(struct usbpd *pd, u32 vdm_hdr, const u32 *vdos, int num_vdos)
return -ENOMEM;
vdm_tx->data[0] = vdm_hdr;
memcpy(&vdm_tx->data[1], vdos, num_vdos * sizeof(u32));
if (vdos && num_vdos)
memcpy(&vdm_tx->data[1], vdos, num_vdos * sizeof(u32));
vdm_tx->size = num_vdos + 1; /* include the header */
/* VDM will get sent in PE_SRC/SNK_READY state handling */

8
drivers/usb/pd/qpnp-pdphy.c
View file

@ -445,8 +445,10 @@ int pd_phy_write(u16 hdr, const u8 *data, size_t data_len,
dev_dbg(pdphy->dev, "%s: hdr %x frame type %d timeout %u\n",
__func__, hdr, type, timeout_ms);
print_hex_dump_debug("tx data obj:", DUMP_PREFIX_NONE, 32, 4,
data, data_len, false);
if (data && data_len)
print_hex_dump_debug("tx data obj:", DUMP_PREFIX_NONE, 32, 4,
data, data_len, false);
if (!pdphy) {
pr_err("%s: pdphy not found\n", __func__);
@ -472,7 +474,7 @@ int pd_phy_write(u16 hdr, const u8 *data, size_t data_len,
if (ret)
return ret;
if (data_len) {
if (data && data_len) {
/* write data objects of SOP message */
ret = pdphy_bulk_reg_write(pdphy, USB_PDPHY_TX_BUFFER_DATA,
data, data_len);