diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-03-21 21:30:24 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-03-21 21:30:24 -0700 |
| commit | 05291016841f7ed5fa1409830fff8dda46c3e448 (patch) | |
| tree | 45813b7ded28eedf6ef24e94db42aa93695a43d5 | |
| parent | 0fb8a4413c36c3695d99784594600184bb7bef89 (diff) | |
| parent | fd8b38e352ea11211116b47983dd37e460a65045 (diff) | |
Merge "soc: qcom: spcom: spcom_device_read() check filp->private_data"
| -rw-r--r-- | drivers/soc/qcom/spcom.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/drivers/soc/qcom/spcom.c b/drivers/soc/qcom/spcom.c index 07610877f140..457361ba5ff8 100644 --- a/drivers/soc/qcom/spcom.c +++ b/drivers/soc/qcom/spcom.c @@ -2241,7 +2241,7 @@ static ssize_t spcom_device_write(struct file *filp, } /** - * spcom_device_read() - handle channel file write() from user space. + * spcom_device_read() - handle channel file read() from user space. * * @filp: file pointer * @@ -2267,6 +2267,16 @@ static ssize_t spcom_device_read(struct file *filp, char __user *user_buff, ch = filp->private_data; + if (ch == NULL) { + pr_err("invalid ch pointer, file [%s].\n", name); + return -EINVAL; + } + + if (!spcom_is_channel_open(ch)) { + pr_err("ch is not open, file [%s].\n", name); + return -EINVAL; + } + buf = kzalloc(size, GFP_KERNEL); if (buf == NULL) return -ENOMEM; @@ -2354,6 +2364,10 @@ static unsigned int spcom_device_poll(struct file *filp, done = (spcom_dev->link_state == GLINK_LINK_STATE_UP); break; case SPCOM_POLL_CH_CONNECT: + if (ch == NULL) { + pr_err("invalid ch pointer, file [%s].\n", name); + return -EINVAL; + } pr_debug("ch [%s] SPCOM_POLL_CH_CONNECT.\n", name); if (wait) { reinit_completion(&ch->connect); |