Skip to content

Commit

Permalink
Input: hideep - fix the uninitialized use in hideep_nvm_unlock()
Browse files Browse the repository at this point in the history
[ Upstream commit cac7100 ]

Inside function hideep_nvm_unlock(), variable "unmask_code" could
be uninitialized if hideep_pgm_r_reg() returns error, however, it
is used in the later if statement after an "and" operation, which
is potentially unsafe.

Signed-off-by: Yizhuo <yzhai003@ucr.edu>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
Yizhuo Zhai authored and gregkh committed Jul 20, 2021
1 parent 1043c57 commit a5dc9f6
Showing 1 changed file with 10 additions and 3 deletions.
13 changes: 10 additions & 3 deletions drivers/input/touchscreen/hideep.c
Expand Up @@ -361,13 +361,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts)
return -EIO;
}

static void hideep_nvm_unlock(struct hideep_ts *ts)
static int hideep_nvm_unlock(struct hideep_ts *ts)
{
u32 unmask_code;
int error;

hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE);
hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code);
hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);
if (error)
return error;

/* make it unprotected code */
unmask_code &= ~HIDEEP_PROT_MODE;
Expand All @@ -384,6 +387,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts)
NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask);
SET_FLASH_HWCONTROL();
hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE);

return 0;
}

static int hideep_check_status(struct hideep_ts *ts)
Expand Down Expand Up @@ -462,7 +467,9 @@ static int hideep_program_nvm(struct hideep_ts *ts,
u32 addr = 0;
int error;

hideep_nvm_unlock(ts);
error = hideep_nvm_unlock(ts);
if (error)
return error;

while (ucode_len > 0) {
xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE);
Expand Down

0 comments on commit a5dc9f6

Please sign in to comment.