summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 70d3146)
raw | patch | inline | side by side (parent: 70d3146)
author | Suman Anna <s-anna@ti.com> | |
Wed, 18 Dec 2019 22:30:15 +0000 (16:30 -0600) | ||
committer | Suman Anna <s-anna@ti.com> | |
Wed, 18 Dec 2019 22:30:15 +0000 (16:30 -0600) |
Fix couple of minor issues reported by the Klocwork static checker
analysis tool:
- Perform a sanity check on the function index against the available
number of functions supported by the rppc device to avoid out-of-bound
array access in rppc_write().
- Remove a stale local variable redefinition to avoid returning an
uninitialized return value in certain paths in rppc_probe().
Fixes: 1b5a3b2ef344 ("rpmsg: rpc: introduce a new rpmsg_rpc driver")
Signed-off-by: Suman Anna <s-anna@ti.com>
analysis tool:
- Perform a sanity check on the function index against the available
number of functions supported by the rppc device to avoid out-of-bound
array access in rppc_write().
- Remove a stale local variable redefinition to avoid returning an
uninitialized return value in certain paths in rppc_probe().
Fixes: 1b5a3b2ef344 ("rpmsg: rpc: introduce a new rpmsg_rpc driver")
Signed-off-by: Suman Anna <s-anna@ti.com>
drivers/rpmsg/rpmsg_rpc.c | patch | blob | history |
index 20941bc0cb03336c58c26f6ba4ecc82a4fc842d5..abffb846ef5f24a63840b22b8879cb5cff687013 100644 (file)
goto failure;
}
goto failure;
}
+ if (function->fxn_id >= rppcdev->num_funcs - 1) {
+ ret = -EINVAL;
+ goto failure;
+ }
+
/* increment the message id and wrap if needed */
rpc->msg_id = (rpc->msg_id + 1) & 0xFFFF;
/* increment the message id and wrap if needed */
rpc->msg_id = (rpc->msg_id + 1) & 0xFFFF;
MKDEV(major, rppcdev->minor), NULL,
namedesc);
if (IS_ERR(rppcdev->dev)) {
MKDEV(major, rppcdev->minor), NULL,
namedesc);
if (IS_ERR(rppcdev->dev)) {
- int ret = PTR_ERR(rppcdev->dev);
+ ret = PTR_ERR(rppcdev->dev);
dev_err(&rpdev->dev, "device_create failed: %d\n", ret);
goto free_cdev;
dev_err(&rpdev->dev, "device_create failed: %d\n", ret);
goto free_cdev;