qcacmn: Check pointer tbuffer always before access it
Pointer tbuffer is allocated from heap or get from other module, it
is checked in some if branch but not every possible NULL branch.
Adding NULL check of tbuffer in every possible branch.
Change-Id: Id3c9f941623995ff73a993e29c53f3b9ce66f10e
CRs-Fixed: 2064350
diff --git a/hif/src/sdio/native_sdio/src/hif.c b/hif/src/sdio/native_sdio/src/hif.c
index 38332c2..f834840 100644
--- a/hif/src/sdio/native_sdio/src/hif.c
+++ b/hif/src/sdio/native_sdio/src/hif.c
@@ -339,7 +339,7 @@
{
uint8_t opcode;
QDF_STATUS status = QDF_STATUS_SUCCESS;
- int ret;
+ int ret = A_OK;
uint8_t *tbuffer;
bool bounced = false;
@@ -484,7 +484,7 @@
("%s: writesb ret=%d address: 0x%X, len: %d, 0x%X\n",
__func__, ret, address, length,
*(int *)tbuffer));
- } else {
+ } else if (tbuffer) {
ret =
sdio_memcpy_toio(device->func, address,
tbuffer, length);
@@ -522,7 +522,7 @@
("%s: readsb ret=%d address: 0x%X, len: %d, 0x%X\n",
__func__, ret, address, length,
*(int *)tbuffer));
- } else {
+ } else if (tbuffer) {
ret =
sdio_memcpy_fromio(device->func,
tbuffer,
@@ -533,7 +533,7 @@
*(int *)tbuffer));
}
#if HIF_USE_DMA_BOUNCE_BUFFER
- if (bounced)
+ if (bounced && tbuffer)
memcpy(buffer, tbuffer, length);
#endif
} else {
@@ -541,7 +541,7 @@
("%s: Invalid direction: 0x%08x\n",
__func__, request));
status = QDF_STATUS_E_INVAL;
- break;
+ return status;
}
if (ret) {
@@ -2388,6 +2388,10 @@
struct hif_sdio_dev *device;
device = get_hif_device(func);
+ if (!device) {
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("get hif device failed\n"));
+ return QDF_STATUS_E_FAILURE;
+ }
if (device->device_state == HIF_DEVICE_STATE_CUTPOWER) {
config = HIF_DEVICE_POWER_UP;
@@ -2419,7 +2423,7 @@
AR_DEBUG_PRINTF(ATH_DEBUG_TRACE,
("%s: +hif_device_resume\n",
__func__));
- if (device && device->claimed_ctx
+ if (device->claimed_ctx
&& osdrv_callbacks.device_suspend_handler) {
status =
osdrv_callbacks.device_resume_handler(device->claimed_ctx);
@@ -2543,9 +2547,18 @@
hifdevice = (struct hif_sdio_dev *) qdf_mem_malloc(sizeof(
struct hif_sdio_dev));
AR_DEBUG_ASSERT(hifdevice != NULL);
+ if (hifdevice == NULL) {
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Alloc hif device fail\n"));
+ return NULL;
+ }
#if HIF_USE_DMA_BOUNCE_BUFFER
hifdevice->dma_buffer = qdf_mem_malloc(HIF_DMA_BUFFER_SIZE);
AR_DEBUG_ASSERT(hifdevice->dma_buffer != NULL);
+ if (hifdevice->dma_buffer == NULL) {
+ qdf_mem_free(hifdevice);
+ AR_DEBUG_PRINTF(ATH_DEBUG_ERROR, ("Alloc dma buffer fail\n"));
+ return NULL;
+ }
#endif
hifdevice->func = func;
hifdevice->power_config = HIF_DEVICE_POWER_UP;