diff options
| author | Przemyslaw Marczak <p.marczak@samsung.com> | 2014-12-15 09:34:10 (GMT) |
|---|---|---|
| committer | Lukasz Majewski <l.majewski@samsung.com> | 2014-12-18 11:26:06 (GMT) |
| commit | 62a96d805f6f212250f5590d6afadf3645837f36 (patch) | |
| tree | cab2a3b4b0b89c888463cc99747b098ef7392348 | |
| parent | 7da6fa27168c468e58814d54fe3f66109036ec2e (diff) | |
| download | u-boot-fsl-qoriq-62a96d805f6f212250f5590d6afadf3645837f36.tar.xz | |
gadget: f_thor: check pointers before use in download_tail()
Some pointers in function download_tail() were not checked
before the use. This could possibly cause the data abort.
To avoid this, check if the pointers are not null is added.
Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[TestHW: Exynos4412-Trats2]
| -rw-r--r-- | drivers/usb/gadget/f_thor.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c index 78519fa..2d0410d 100644 --- a/drivers/usb/gadget/f_thor.c +++ b/drivers/usb/gadget/f_thor.c @@ -205,12 +205,24 @@ static long long int download_head(unsigned long long total, static int download_tail(long long int left, int cnt) { - struct dfu_entity *dfu_entity = dfu_get_entity(alt_setting_num); - void *transfer_buffer = dfu_get_buf(dfu_entity); + struct dfu_entity *dfu_entity; + void *transfer_buffer; int ret; debug("%s: left: %llu cnt: %d\n", __func__, left, cnt); + dfu_entity = dfu_get_entity(alt_setting_num); + if (!dfu_entity) { + error("Alt setting: %d entity not found!\n", alt_setting_num); + return -ENOENT; + } + + transfer_buffer = dfu_get_buf(dfu_entity); + if (!transfer_buffer) { + error("Transfer buffer not allocated!"); + return -ENXIO; + } + if (left) { ret = dfu_write(dfu_entity, transfer_buffer, left, cnt++); if (ret) { |