Skip to content

Commit 2269583

Browse files
Dan Carpenterwsakernel
authored andcommitted
i2c: cp2615: check for allocation failure in cp2615_i2c_recv()
We need to add a check for if the kzalloc() fails. Fixes: 4a76954 ("i2c: cp2615: add i2c driver for Silicon Labs' CP2615 Digital Audio Bridge") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Bence Csókás <[email protected]> Signed-off-by: Wolfram Sang <[email protected]>
1 parent 065b621 commit 2269583

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

drivers/i2c/busses/i2c-cp2615.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -138,17 +138,23 @@ cp2615_i2c_send(struct usb_interface *usbif, struct cp2615_i2c_transfer *i2c_w)
138138
static int
139139
cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf)
140140
{
141-
struct cp2615_iop_msg *msg = kzalloc(sizeof(*msg), GFP_KERNEL);
142-
struct cp2615_i2c_transfer_result *i2c_r = (struct cp2615_i2c_transfer_result *)&msg->data;
143141
struct usb_device *usbdev = interface_to_usbdev(usbif);
144-
int res = usb_bulk_msg(usbdev, usb_rcvbulkpipe(usbdev, IOP_EP_IN),
145-
msg, sizeof(struct cp2615_iop_msg), NULL, 0);
142+
struct cp2615_iop_msg *msg;
143+
struct cp2615_i2c_transfer_result *i2c_r;
144+
int res;
145+
146+
msg = kzalloc(sizeof(*msg), GFP_KERNEL);
147+
if (!msg)
148+
return -ENOMEM;
146149

150+
res = usb_bulk_msg(usbdev, usb_rcvbulkpipe(usbdev, IOP_EP_IN), msg,
151+
sizeof(struct cp2615_iop_msg), NULL, 0);
147152
if (res < 0) {
148153
kfree(msg);
149154
return res;
150155
}
151156

157+
i2c_r = (struct cp2615_i2c_transfer_result *)&msg->data;
152158
if (msg->msg != htons(iop_I2cTransferResult) || i2c_r->tag != tag) {
153159
kfree(msg);
154160
return -EIO;

0 commit comments

Comments
 (0)