diff options
Diffstat (limited to 'drivers/iio/common/ssp_sensors/ssp_spi.c')
| -rw-r--r-- | drivers/iio/common/ssp_sensors/ssp_spi.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c index 4864c38b8d1c..b7f093d7345b 100644 --- a/drivers/iio/common/ssp_sensors/ssp_spi.c +++ b/drivers/iio/common/ssp_sensors/ssp_spi.c @@ -104,7 +104,7 @@ static struct ssp_msg *ssp_create_msg(u8 cmd, u16 len, u16 opt, u32 data) /* * It is a bit heavy to do it this way but often the function is used to compose * the message from smaller chunks which are placed on the stack. Often the - * chunks are small so memcpy should be optimalized. + * chunks are small so memcpy should be optimized. */ static inline void ssp_fill_buffer(struct ssp_msg *m, unsigned int offset, const void *src, unsigned int len) @@ -137,7 +137,7 @@ static int ssp_print_mcu_debug(char *data_frame, int *data_index, if (length > received_len - *data_index || length <= 0) { ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n", length, received_len); - return length ? length : -EPROTO; + return -EPROTO; } ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]); @@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) for (idx = 0; idx < len;) { switch (dataframe[idx++]) { case SSP_MSG2AP_INST_BYPASS_DATA: + if (idx >= len) + return -EPROTO; sd = dataframe[idx++]; if (sd < 0 || sd >= SSP_SENSOR_MAX) { dev_err(SSP_DEV, @@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) if (indio_devs[sd]) { spd = iio_priv(indio_devs[sd]); - if (spd->process_data) + if (spd->process_data) { + if (idx >= len) + return -EPROTO; spd->process_data(indio_devs[sd], &dataframe[idx], data->timestamp); + } } else { dev_err(SSP_DEV, "no client for frame\n"); } @@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) idx += ssp_offset_map[sd]; break; case SSP_MSG2AP_INST_DEBUG_DATA: + if (idx >= len) + return -EPROTO; sd = ssp_print_mcu_debug(dataframe, &idx, len); if (sd) { dev_err(SSP_DEV, @@ -324,12 +331,11 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len) /* threaded irq */ int ssp_irq_msg(struct ssp_data *data) { - bool found = false; char *buffer; u8 msg_type; int ret; u16 length, msg_options; - struct ssp_msg *msg, *n; + struct ssp_msg *msg = NULL, *iter, *n; ret = spi_read(data->spi, data->header_buffer, SSP_HEADER_BUFFER_SIZE); if (ret < 0) { @@ -355,15 +361,15 @@ int ssp_irq_msg(struct ssp_data *data) * received with no order */ mutex_lock(&data->pending_lock); - list_for_each_entry_safe(msg, n, &data->pending_list, list) { - if (msg->options == msg_options) { - list_del(&msg->list); - found = true; + list_for_each_entry_safe(iter, n, &data->pending_list, list) { + if (iter->options == msg_options) { + list_del(&iter->list); + msg = iter; break; } } - if (!found) { + if (!msg) { /* * here can be implemented dead messages handling * but the slave should not send such ones - it is to |