| From c06e374efd366c8ffa51ea9f1fd919e273c3ffc1 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 19 Jun 2021 22:26:50 -0700 |
| Subject: Input: hideep - fix the uninitialized use in hideep_nvm_unlock() |
| |
| From: Yizhuo Zhai <yzhai003@ucr.edu> |
| |
| [ Upstream commit cac7100d4c51c04979dacdfe6c9a5e400d3f0a27 ] |
| |
| Inside function hideep_nvm_unlock(), variable "unmask_code" could |
| be uninitialized if hideep_pgm_r_reg() returns error, however, it |
| is used in the later if statement after an "and" operation, which |
| is potentially unsafe. |
| |
| Signed-off-by: Yizhuo <yzhai003@ucr.edu> |
| Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/input/touchscreen/hideep.c | 13 ++++++++++--- |
| 1 file changed, 10 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c |
| index ddad4a82a5e5..e9547ee29756 100644 |
| --- a/drivers/input/touchscreen/hideep.c |
| +++ b/drivers/input/touchscreen/hideep.c |
| @@ -361,13 +361,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts) |
| return -EIO; |
| } |
| |
| -static void hideep_nvm_unlock(struct hideep_ts *ts) |
| +static int hideep_nvm_unlock(struct hideep_ts *ts) |
| { |
| u32 unmask_code; |
| + int error; |
| |
| hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE); |
| - hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); |
| + error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); |
| hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); |
| + if (error) |
| + return error; |
| |
| /* make it unprotected code */ |
| unmask_code &= ~HIDEEP_PROT_MODE; |
| @@ -384,6 +387,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts) |
| NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask); |
| SET_FLASH_HWCONTROL(); |
| hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); |
| + |
| + return 0; |
| } |
| |
| static int hideep_check_status(struct hideep_ts *ts) |
| @@ -462,7 +467,9 @@ static int hideep_program_nvm(struct hideep_ts *ts, |
| u32 addr = 0; |
| int error; |
| |
| - hideep_nvm_unlock(ts); |
| + error = hideep_nvm_unlock(ts); |
| + if (error) |
| + return error; |
| |
| while (ucode_len > 0) { |
| xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE); |
| -- |
| 2.30.2 |
| |