From c28a277ec89d7e914544ca27557141253229acca Mon Sep 17 00:00:00 2001 From: Meng Wang Date: Fri, 4 Mar 2016 09:52:50 +0800 Subject: [PATCH] ASoc: soundwire: add null check before using map Pointer map returned from dev_get_name may be null. Add null check before derefering. CRs-Fixed: 985337 Change-Id: I952ae63e9b909dde763b3024d90fe4553e852860 Signed-off-by: Meng Wang --- drivers/base/regmap/regmap-swr.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/drivers/base/regmap/regmap-swr.c b/drivers/base/regmap/regmap-swr.c index 3795217ed2cb..5ea67421ed85 100644 --- a/drivers/base/regmap/regmap-swr.c +++ b/drivers/base/regmap/regmap-swr.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -61,10 +61,10 @@ static int regmap_swr_raw_multi_reg_write(void *context, const void *data, struct device *dev = context; struct swr_device *swr = to_swr_device(dev); struct regmap *map = dev_get_regmap(dev, NULL); - size_t addr_bytes = map->format.reg_bytes; - size_t val_bytes = map->format.val_bytes; - size_t pad_bytes = map->format.pad_bytes; - size_t num_regs = (count / (addr_bytes + val_bytes + pad_bytes)); + size_t addr_bytes; + size_t val_bytes; + size_t pad_bytes; + size_t num_regs; int i = 0; int ret = 0; u16 *reg; @@ -76,6 +76,21 @@ static int regmap_swr_raw_multi_reg_write(void *context, const void *data, return -EINVAL; } + if (map == NULL) { + dev_err(dev, "%s: regmap is NULL\n", __func__); + return -EINVAL; + } + + addr_bytes = map->format.reg_bytes; + val_bytes = map->format.val_bytes; + pad_bytes = map->format.pad_bytes; + + if (addr_bytes + val_bytes + pad_bytes == 0) { + dev_err(dev, "%s: sum of addr, value and pad is 0\n", __func__); + return -EINVAL; + } + num_regs = count / (addr_bytes + val_bytes + pad_bytes); + reg = kcalloc(num_regs, sizeof(u16), GFP_KERNEL); if (!reg) return -ENOMEM;