Skip to content

Commit a489afc

Browse files
plbossartvinodkoul
authored andcommitted
soundwire: mipi-disco: add error handling for property array read
The existing code assumes that there are no possible errors when using fwnode_property_read_u32_array(), because fwnode_property_count_u32() reads this array to determine its number of elements. We need to also protect the second read to be completely bullet-proof. Suggested-by: Andy Shevchenko <[email protected]> Signed-off-by: Pierre-Louis Bossart <[email protected]> Signed-off-by: Bard Liao <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]>
1 parent 1ae4aa5 commit a489afc

File tree

1 file changed

+24
-8
lines changed

1 file changed

+24
-8
lines changed

drivers/soundwire/mipi_disco.c

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,9 @@ int sdw_master_read_prop(struct sdw_bus *bus)
5252
struct sdw_master_prop *prop = &bus->prop;
5353
struct fwnode_handle *link;
5454
char name[32];
55-
int nval, i;
55+
int nval;
56+
int ret;
57+
int i;
5658

5759
device_property_read_u32(bus->dev,
5860
"mipi-sdw-sw-interface-revision",
@@ -91,9 +93,11 @@ int sdw_master_read_prop(struct sdw_bus *bus)
9193
return -ENOMEM;
9294
}
9395

94-
fwnode_property_read_u32_array(link,
96+
ret = fwnode_property_read_u32_array(link,
9597
"mipi-sdw-clock-frequencies-supported",
9698
prop->clk_freq, prop->num_clk_freq);
99+
if (ret < 0)
100+
return ret;
97101
}
98102

99103
/*
@@ -119,10 +123,12 @@ int sdw_master_read_prop(struct sdw_bus *bus)
119123
return -ENOMEM;
120124
}
121125

122-
fwnode_property_read_u32_array(link,
126+
ret = fwnode_property_read_u32_array(link,
123127
"mipi-sdw-supported-clock-gears",
124128
prop->clk_gears,
125129
prop->num_clk_gears);
130+
if (ret < 0)
131+
return ret;
126132
}
127133

128134
fwnode_property_read_u32(link, "mipi-sdw-default-frame-rate",
@@ -151,6 +157,7 @@ static int sdw_slave_read_dp0(struct sdw_slave *slave,
151157
struct sdw_dp0_prop *dp0)
152158
{
153159
int nval;
160+
int ret;
154161

155162
fwnode_property_read_u32(port, "mipi-sdw-port-max-wordlength",
156163
&dp0->max_word);
@@ -168,9 +175,11 @@ static int sdw_slave_read_dp0(struct sdw_slave *slave,
168175
if (!dp0->words)
169176
return -ENOMEM;
170177

171-
fwnode_property_read_u32_array(port,
178+
ret = fwnode_property_read_u32_array(port,
172179
"mipi-sdw-port-wordlength-configs",
173180
dp0->words, dp0->num_words);
181+
if (ret < 0)
182+
return ret;
174183
}
175184

176185
dp0->BRA_flow_controlled = mipi_fwnode_property_read_bool(port,
@@ -191,9 +200,10 @@ static int sdw_slave_read_dpn(struct sdw_slave *slave,
191200
{
192201
struct fwnode_handle *node;
193202
u32 bit, i = 0;
194-
int nval;
195203
unsigned long addr;
196204
char name[40];
205+
int nval;
206+
int ret;
197207

198208
addr = ports;
199209
/* valid ports are 1 to 14 so apply mask */
@@ -228,9 +238,11 @@ static int sdw_slave_read_dpn(struct sdw_slave *slave,
228238
return -ENOMEM;
229239
}
230240

231-
fwnode_property_read_u32_array(node,
241+
ret = fwnode_property_read_u32_array(node,
232242
"mipi-sdw-port-wordlength-configs",
233243
dpn[i].words, dpn[i].num_words);
244+
if (ret < 0)
245+
return ret;
234246
}
235247

236248
fwnode_property_read_u32(node, "mipi-sdw-data-port-type",
@@ -269,9 +281,11 @@ static int sdw_slave_read_dpn(struct sdw_slave *slave,
269281
return -ENOMEM;
270282
}
271283

272-
fwnode_property_read_u32_array(node,
284+
ret = fwnode_property_read_u32_array(node,
273285
"mipi-sdw-channel-number-list",
274286
dpn[i].channels, dpn[i].num_channels);
287+
if (ret < 0)
288+
return ret;
275289
}
276290

277291
nval = fwnode_property_count_u32(node, "mipi-sdw-channel-combination-list");
@@ -286,10 +300,12 @@ static int sdw_slave_read_dpn(struct sdw_slave *slave,
286300
return -ENOMEM;
287301
}
288302

289-
fwnode_property_read_u32_array(node,
303+
ret = fwnode_property_read_u32_array(node,
290304
"mipi-sdw-channel-combination-list",
291305
dpn[i].ch_combinations,
292306
dpn[i].num_ch_combinations);
307+
if (ret < 0)
308+
return ret;
293309
}
294310

295311
fwnode_property_read_u32(node,

0 commit comments

Comments
 (0)