From: Yizhuo Zhai yzhai003@ucr.edu
[ Upstream commit cac7100d4c51c04979dacdfe6c9a5e400d3f0a27 ]
Inside function hideep_nvm_unlock(), variable "unmask_code" could be uninitialized if hideep_pgm_r_reg() returns error, however, it is used in the later if statement after an "and" operation, which is potentially unsafe.
Signed-off-by: Yizhuo yzhai003@ucr.edu Signed-off-by: Dmitry Torokhov dmitry.torokhov@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/input/touchscreen/hideep.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c index f1cd4dd9a4a3..d7775db0b711 100644 --- a/drivers/input/touchscreen/hideep.c +++ b/drivers/input/touchscreen/hideep.c @@ -364,13 +364,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts) return -EIO; }
-static void hideep_nvm_unlock(struct hideep_ts *ts) +static int hideep_nvm_unlock(struct hideep_ts *ts) { u32 unmask_code; + int error;
hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE); - hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); + error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); + if (error) + return error;
/* make it unprotected code */ unmask_code &= ~HIDEEP_PROT_MODE; @@ -387,6 +390,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts) NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask); SET_FLASH_HWCONTROL(); hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); + + return 0; }
static int hideep_check_status(struct hideep_ts *ts) @@ -465,7 +470,9 @@ static int hideep_program_nvm(struct hideep_ts *ts, u32 addr = 0; int error;
- hideep_nvm_unlock(ts); + error = hideep_nvm_unlock(ts); + if (error) + return error;
while (ucode_len > 0) { xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE);