lkml.org 
[lkml]   [2021]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 125/351] Input: hideep - fix the uninitialized use in hideep_nvm_unlock()
    Date
    From: Yizhuo Zhai <yzhai003@ucr.edu>

    [ Upstream commit cac7100d4c51c04979dacdfe6c9a5e400d3f0a27 ]

    Inside function hideep_nvm_unlock(), variable "unmask_code" could
    be uninitialized if hideep_pgm_r_reg() returns error, however, it
    is used in the later if statement after an "and" operation, which
    is potentially unsafe.

    Signed-off-by: Yizhuo <yzhai003@ucr.edu>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/input/touchscreen/hideep.c | 13 ++++++++++---
    1 file changed, 10 insertions(+), 3 deletions(-)

    diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c
    index ddad4a82a5e5..e9547ee29756 100644
    --- a/drivers/input/touchscreen/hideep.c
    +++ b/drivers/input/touchscreen/hideep.c
    @@ -361,13 +361,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts)
    return -EIO;
    }

    -static void hideep_nvm_unlock(struct hideep_ts *ts)
    +static int hideep_nvm_unlock(struct hideep_ts *ts)
    {
    u32 unmask_code;
    + int error;

    hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE);
    - hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
    + error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
    hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
    + if (error)
    + return error;

    /* make it unprotected code */
    unmask_code &= ~HIDEEP_PROT_MODE;
    @@ -384,6 +387,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts)
    NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask);
    SET_FLASH_HWCONTROL();
    hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
    +
    + return 0;
    }

    static int hideep_check_status(struct hideep_ts *ts)
    @@ -462,7 +467,9 @@ static int hideep_program_nvm(struct hideep_ts *ts,
    u32 addr = 0;
    int error;

    - hideep_nvm_unlock(ts);
    + error = hideep_nvm_unlock(ts);
    + if (error)
    + return error;

    while (ucode_len > 0) {
    xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-19 19:40    [W:4.027 / U:0.608 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site