summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPrzemyslaw Marczak <p.marczak@samsung.com>2014-12-15 10:34:10 +0100
committerLukasz Majewski <l.majewski@samsung.com>2014-12-18 12:26:06 +0100
commit62a96d805f6f212250f5590d6afadf3645837f36 (patch)
treecab2a3b4b0b89c888463cc99747b098ef7392348
parent7da6fa27168c468e58814d54fe3f66109036ec2e (diff)
downloadu-boot-imx-62a96d805f6f212250f5590d6afadf3645837f36.zip
u-boot-imx-62a96d805f6f212250f5590d6afadf3645837f36.tar.gz
u-boot-imx-62a96d805f6f212250f5590d6afadf3645837f36.tar.bz2
gadget: f_thor: check pointers before use in download_tail()
Some pointers in function download_tail() were not checked before the use. This could possibly cause the data abort. To avoid this, check if the pointers are not null is added. Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com> Tested-by: Lukasz Majewski <l.majewski@samsung.com> [TestHW: Exynos4412-Trats2]
-rw-r--r--drivers/usb/gadget/f_thor.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/drivers/usb/gadget/f_thor.c b/drivers/usb/gadget/f_thor.c
index 78519fa..2d0410d 100644
--- a/drivers/usb/gadget/f_thor.c
+++ b/drivers/usb/gadget/f_thor.c
@@ -205,12 +205,24 @@ static long long int download_head(unsigned long long total,
static int download_tail(long long int left, int cnt)
{
- struct dfu_entity *dfu_entity = dfu_get_entity(alt_setting_num);
- void *transfer_buffer = dfu_get_buf(dfu_entity);
+ struct dfu_entity *dfu_entity;
+ void *transfer_buffer;
int ret;
debug("%s: left: %llu cnt: %d\n", __func__, left, cnt);
+ dfu_entity = dfu_get_entity(alt_setting_num);
+ if (!dfu_entity) {
+ error("Alt setting: %d entity not found!\n", alt_setting_num);
+ return -ENOENT;
+ }
+
+ transfer_buffer = dfu_get_buf(dfu_entity);
+ if (!transfer_buffer) {
+ error("Transfer buffer not allocated!");
+ return -ENXIO;
+ }
+
if (left) {
ret = dfu_write(dfu_entity, transfer_buffer, left, cnt++);
if (ret) {