caif: Bugfix add check NULL pointer before calling functions.

Add check on layer->dn != NULL before calling functions in layer below. Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>

caif: Bugfix add check NULL pointer before calling functions.
Add check on layer->dn != NULL before calling functions in layer below. Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
sjur.brandeland@stericsson.com · David S. Miller
1 parent 71a8638480
Showing 1 changed file with 26 additions and 9 deletions Side-by-side Diff
net/caif/cfctrl.c
@@ -178,20 +178,23 @@
 void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
 {
 	struct cfctrl *cfctrl = container_obj(layer);
-	int ret;
 	struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
+	struct cflayer *dn = cfctrl->serv.layer.dn;
 	if (!pkt) {
 		pr_warn("Out of memory\n");
 		return;
 	}
+	if (!dn) {
+		pr_debug("not able to send enum request\n");
+		return;
+	}
 	caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
 	init_info(cfpkt_info(pkt), cfctrl);
 	cfpkt_info(pkt)->dev_info->id = physlinkid;
 	cfctrl->serv.dev_info.id = physlinkid;
 	cfpkt_addbdy(pkt, CFCTRL_CMD_ENUM);
 	cfpkt_addbdy(pkt, physlinkid);
-	ret =
-	    cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+	dn->transmit(dn, pkt);
 }
  
 int cfctrl_linkup_request(struct cflayer *layer,
  
@@ -206,7 +209,13 @@
 	int ret;
 	char utility_name[16];
 	struct cfpkt *pkt;
+	struct cflayer *dn = cfctrl->serv.layer.dn;
  
+	if (!dn) {
+		pr_debug("not able to send linkup request\n");
+		return -ENODEV;
+	}
+
 	if (cfctrl_cancel_req(layer, user_layer) > 0) {
 		/* Slight Paranoia, check if already connecting */
 		pr_err("Duplicate connect request for same client\n");
@@ -282,7 +291,7 @@
 	 */
 	cfpkt_info(pkt)->dev_info->id = param->phyid;
 	ret =
-	    cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+	    dn->transmit(dn, pkt);
 	if (ret < 0) {
 		int count;
  
  
  
@@ -301,15 +310,23 @@
 	int ret;
 	struct cfctrl *cfctrl = container_obj(layer);
 	struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
+	struct cflayer *dn = cfctrl->serv.layer.dn;
+
 	if (!pkt) {
 		pr_warn("Out of memory\n");
 		return -ENOMEM;
 	}
+
+	if (!dn) {
+		pr_debug("not able to send link-down request\n");
+		return -ENODEV;
+	}
+
 	cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
 	cfpkt_addbdy(pkt, channelid);
 	init_info(cfpkt_info(pkt), cfctrl);
 	ret =
-	    cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
+	    dn->transmit(dn, pkt);
 #ifndef CAIF_NO_LOOP
 	cfctrl->loop_linkused[channelid] = 0;
 #endif
@@ -477,7 +494,7 @@
 				cfpkt_extr_head(pkt, &param, len);
 				break;
 			default:
-				pr_warn("Request setup - invalid link type (%d)\n",
+				pr_warn("Request setup, invalid type (%d)\n",
 					serv);
 				goto error;
 			}
@@ -489,7 +506,8 @@
  
 			if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) ||
 				cfpkt_erroneous(pkt)) {
-				pr_err("Invalid O/E bit or parse error on CAIF control channel\n");
+				pr_err("Invalid O/E bit or parse error "
+						"on CAIF control channel\n");
 				cfctrl->res.reject_rsp(cfctrl->serv.layer.up,
 						       0,
 						       req ? req->client_layer
  
@@ -550,9 +568,8 @@
 	case _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND:
 	case CAIF_CTRLCMD_FLOW_OFF_IND:
 		spin_lock_bh(&this->info_list_lock);
-		if (!list_empty(&this->list)) {
+		if (!list_empty(&this->list))
 			pr_debug("Received flow off in control layer\n");
-		}
 		spin_unlock_bh(&this->info_list_lock);
 		break;
 	case _CAIF_CTRLCMD_PHYIF_DOWN_IND: {
...	...	@@ -178,20 +178,23 @@
178	178	void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
179	179	{
180	180	struct cfctrl *cfctrl = container_obj(layer);
181		- int ret;
182	181	struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
	182	+ struct cflayer *dn = cfctrl->serv.layer.dn;
183	183	if (!pkt) {
184	184	pr_warn("Out of memory\n");
185	185	return;
186	186	}
	187	+ if (!dn) {
	188	+ pr_debug("not able to send enum request\n");
	189	+ return;
	190	+ }
187	191	caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
188	192	init_info(cfpkt_info(pkt), cfctrl);
189	193	cfpkt_info(pkt)->dev_info->id = physlinkid;
190	194	cfctrl->serv.dev_info.id = physlinkid;
191	195	cfpkt_addbdy(pkt, CFCTRL_CMD_ENUM);
192	196	cfpkt_addbdy(pkt, physlinkid);
193		- ret =
194		- cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
	197	+ dn->transmit(dn, pkt);
195	198	}
196	199
197	200	int cfctrl_linkup_request(struct cflayer *layer,
198	201
...	...	@@ -206,7 +209,13 @@
206	209	int ret;
207	210	char utility_name[16];
208	211	struct cfpkt *pkt;
	212	+ struct cflayer *dn = cfctrl->serv.layer.dn;
209	213
	214	+ if (!dn) {
	215	+ pr_debug("not able to send linkup request\n");
	216	+ return -ENODEV;
	217	+ }
	218	+
210	219	if (cfctrl_cancel_req(layer, user_layer) > 0) {
211	220	/* Slight Paranoia, check if already connecting */
212	221	pr_err("Duplicate connect request for same client\n");
...	...	@@ -282,7 +291,7 @@
282	291	*/
283	292	cfpkt_info(pkt)->dev_info->id = param->phyid;
284	293	ret =
285		- cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
	294	+ dn->transmit(dn, pkt);
286	295	if (ret < 0) {
287	296	int count;
288	297
289	298
290	299
...	...	@@ -301,15 +310,23 @@
301	310	int ret;
302	311	struct cfctrl *cfctrl = container_obj(layer);
303	312	struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
	313	+ struct cflayer *dn = cfctrl->serv.layer.dn;
	314	+
304	315	if (!pkt) {
305	316	pr_warn("Out of memory\n");
306	317	return -ENOMEM;
307	318	}
	319	+
	320	+ if (!dn) {
	321	+ pr_debug("not able to send link-down request\n");
	322	+ return -ENODEV;
	323	+ }
	324	+
308	325	cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
309	326	cfpkt_addbdy(pkt, channelid);
310	327	init_info(cfpkt_info(pkt), cfctrl);
311	328	ret =
312		- cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
	329	+ dn->transmit(dn, pkt);
313	330	#ifndef CAIF_NO_LOOP
314	331	cfctrl->loop_linkused[channelid] = 0;
315	332	#endif
...	...	@@ -477,7 +494,7 @@
477	494	cfpkt_extr_head(pkt, &param, len);
478	495	break;
479	496	default:
480		- pr_warn("Request setup - invalid link type (%d)\n",
	497	+ pr_warn("Request setup, invalid type (%d)\n",
481	498	serv);
482	499	goto error;
483	500	}
...	...	@@ -489,7 +506,8 @@
489	506
490	507	if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) \|\|
491	508	cfpkt_erroneous(pkt)) {
492		- pr_err("Invalid O/E bit or parse error on CAIF control channel\n");
	509	+ pr_err("Invalid O/E bit or parse error "
	510	+ "on CAIF control channel\n");
493	511	cfctrl->res.reject_rsp(cfctrl->serv.layer.up,
494	512	0,
495	513	req ? req->client_layer
496	514
...	...	@@ -550,9 +568,8 @@
550	568	case _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND:
551	569	case CAIF_CTRLCMD_FLOW_OFF_IND:
552	570	spin_lock_bh(&this->info_list_lock);
553		- if (!list_empty(&this->list)) {
	571	+ if (!list_empty(&this->list))
554	572	pr_debug("Received flow off in control layer\n");
555		- }
556	573	spin_unlock_bh(&this->info_list_lock);
557	574	break;
558	575	case _CAIF_CTRLCMD_PHYIF_DOWN_IND: {