lkml.org 
[lkml]   [2012]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[25/67] mfd: Fix twl-core oops while calling twl_i2c_* for unbound driver
    3.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Ilya Yanok <yanok@emcraft.com>

    commit 8653be1afd60d6e8c36139b487e375b70357d9ef upstream.

    Check inuse variable before trying to access twl_map to prevent
    dereferencing of uninitialized variable.

    Signed-off-by: Ilya Yanok <yanok@emcraft.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/mfd/twl-core.c | 16 ++++++++--------
    1 file changed, 8 insertions(+), 8 deletions(-)

    --- a/drivers/mfd/twl-core.c
    +++ b/drivers/mfd/twl-core.c
    @@ -362,13 +362,13 @@ int twl_i2c_write(u8 mod_no, u8 *value,
    pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
    return -EPERM;
    }
    - sid = twl_map[mod_no].sid;
    - twl = &twl_modules[sid];
    -
    if (unlikely(!inuse)) {
    - pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
    + pr_err("%s: not initialized\n", DRIVER_NAME);
    return -EPERM;
    }
    + sid = twl_map[mod_no].sid;
    + twl = &twl_modules[sid];
    +
    mutex_lock(&twl->xfer_lock);
    /*
    * [MSG1]: fill the register address data
    @@ -419,13 +419,13 @@ int twl_i2c_read(u8 mod_no, u8 *value, u
    pr_err("%s: invalid module number %d\n", DRIVER_NAME, mod_no);
    return -EPERM;
    }
    - sid = twl_map[mod_no].sid;
    - twl = &twl_modules[sid];
    -
    if (unlikely(!inuse)) {
    - pr_err("%s: client %d is not initialized\n", DRIVER_NAME, sid);
    + pr_err("%s: not initialized\n", DRIVER_NAME);
    return -EPERM;
    }
    + sid = twl_map[mod_no].sid;
    + twl = &twl_modules[sid];
    +
    mutex_lock(&twl->xfer_lock);
    /* [MSG1] fill the register address data */
    msg = &twl->xfer_msg[0];



    \
     
     \ /
      Last update: 2012-01-04 00:09    [W:0.019 / U:32.692 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site