slimbus: Fix multiple corner cases
Initialize the variable before accessing it. Also ensure that it does
not get used outside its intended scope.
Always check for the validity of a pointer before accessing it.
CRs-Fixed: 2121178
Change-Id: I08fdb1bf8445ac9d321eb3433c6a935f34bae437
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
diff --git a/drivers/slimbus/slim-msm-ngd.c b/drivers/slimbus/slim-msm-ngd.c
index ca56462..5fb0c29 100644
--- a/drivers/slimbus/slim-msm-ngd.c
+++ b/drivers/slimbus/slim-msm-ngd.c
@@ -422,9 +422,11 @@
u8 txn_mt;
u16 txn_mc = txn->mc;
u8 wbuf[SLIM_MSGQ_BUF_LEN];
+ const u8 *old_wbuf = NULL;
bool report_sat = false;
bool sync_wr = true;
+ memset(wbuf, 0, sizeof(wbuf));
if (txn->mc & SLIM_MSG_CLK_PAUSE_SEQ_FLG)
return -EPROTONOSUPPORT;
@@ -590,6 +592,7 @@
goto ngd_xfer_err;
}
txn->len = i;
+ old_wbuf = txn->wbuf;
txn->wbuf = wbuf;
txn->rl = txn->len + 4;
}
@@ -758,13 +761,18 @@
ctrl->txnt[txn->tid] = NULL;
spin_unlock_irqrestore(&ctrl->txn_lock, flags);
}
- return ret ? ret : dev->err;
+ goto ngd_xfer_ret;
}
ngd_xfer_err:
if (!report_sat) {
mutex_unlock(&dev->tx_lock);
msm_slim_put_ctrl(dev);
}
+ngd_xfer_ret:
+ if (txn->wbuf == wbuf)
+ txn->wbuf = old_wbuf;
+ if (txn->comp == &done)
+ txn->comp = NULL;
return ret ? ret : dev->err;
}
diff --git a/drivers/slimbus/slimbus.c b/drivers/slimbus/slimbus.c
index 3ae9a10..4c9210a 100644
--- a/drivers/slimbus/slimbus.c
+++ b/drivers/slimbus/slimbus.c
@@ -2512,7 +2512,7 @@
}
}
/* schedule 4k family channels */
- while (coeff1 < ctrl->sched.num_cc1 &&
+ while (coeff1 < ctrl->sched.num_cc1 && slc1 &&
curexp == (int)slc1->rootexp + expshft) {
/* searchorder effective when opensl valid */
static const int srcho[] = { 5, 2, 4, 1, 3, 0 };