diff options
| author | Deven Patel <cdevenp@codeaurora.org> | 2016-03-07 10:14:39 -0800 |
|---|---|---|
| committer | David Keitel <dkeitel@codeaurora.org> | 2016-03-25 16:03:12 -0700 |
| commit | c594314ae595d80b3551e2286aedf2cae920c5e5 (patch) | |
| tree | 9ba58fb2603992b9b955d476b80e63dc28a4f8ae | |
| parent | 016e977b8e30738f76b1c40a81cf4bcb01f06a65 (diff) | |
drivers: soc: Fix possible APR null pointer dereference
There's a possible null pointer deference if APR open fails.
Add the fix to handle error case cleanup gracefully.
CRs-fixed: 979283
Change-Id: I4c0cc05bf08d2eae5c27a1dba0a33f4183f81cf3
Signed-off-by: Deven Patel <cdevenp@codeaurora.org>
| -rw-r--r-- | drivers/soc/qcom/qdsp6v2/apr_tal_glink.c | 20 |
1 files changed, 9 insertions, 11 deletions
diff --git a/drivers/soc/qcom/qdsp6v2/apr_tal_glink.c b/drivers/soc/qcom/qdsp6v2/apr_tal_glink.c index b6ace477c8f3..fb3ce963a1a9 100644 --- a/drivers/soc/qcom/qdsp6v2/apr_tal_glink.c +++ b/drivers/soc/qcom/qdsp6v2/apr_tal_glink.c @@ -256,7 +256,7 @@ struct apr_svc_ch_dev *apr_tal_open(uint32_t clnt, uint32_t dest, uint32_t dl, mutex_lock(&apr_ch->m_lock); if (apr_ch->handle) { pr_err("%s: This channel is already opened\n", __func__); - apr_ch = NULL; + rc = -EBUSY; goto unlock; } @@ -299,30 +299,28 @@ struct apr_svc_ch_dev *apr_tal_open(uint32_t clnt, uint32_t dest, uint32_t dl, if (rc == 0) { pr_err("%s: TIMEOUT for OPEN event\n", __func__); rc = -ETIMEDOUT; - goto unlock; + goto close_link; } rc = apr_tal_rx_intents_config(apr_ch, APR_DEFAULT_NUM_OF_INTENTS, APR_MAX_BUF); if (rc) { pr_err("%s: Unable to queue intents\n", __func__); - goto unlock; + goto close_link; } apr_ch->func = func; apr_ch->priv = priv; -unlock: - if (rc && apr_ch) { - if (apr_ch->handle) { - glink_close(apr_ch->handle); - apr_ch->handle = NULL; - } - apr_ch = NULL; +close_link: + if (rc) { + glink_close(apr_ch->handle); + apr_ch->handle = NULL; } +unlock: mutex_unlock(&apr_ch->m_lock); - return apr_ch; + return rc ? NULL : apr_ch; } int apr_tal_close(struct apr_svc_ch_dev *apr_ch) |