github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-30 19:21:28 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

input: qcom-hv-haptics: check playing effect pointer in IRQ handler

Browse Source 
When uploading a constant effect after stopping FIFO play, the effect
pointer in haptics_play_info structure will be set to NULL. If there
is any pending fifo-empty IRQ gets served after that, it will trigger
a NULL pointer dereference issue. To avoid this, check the playing
effect pointer before use it in the IRQ handler.

Change-Id: Iacfea5e48d0a9519fa2c930ec821e395c43b6281
Signed-off-by: Fenglin Wu <fenglinw@codeaurora.org>
This commit is contained in:
Fenglin Wu 2021-01-11 08:07:02 +08:00 committed by David Collins
parent 6e93432c87
commit f0d2102bf1
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/input/misc/qcom-hv-haptics.c
View File

@ -2500,8 +2500,8 @@ static int haptics_hw_init(struct haptics_chip *chip)
static irqreturn_t fifo_empty_irq_handler(int irq, void *data)
{
struct haptics_chip *chip = data;
struct fifo_cfg *fifo = chip->play.effect->fifo;
struct fifo_play_status *status = &chip->play.fifo_status;
struct fifo_cfg *fifo;
struct fifo_play_status *status;
u32 samples_left;
u8 *samples, val;
int rc, num;
@ -2515,7 +2515,8 @@ static irqreturn_t fifo_empty_irq_handler(int irq, void *data)
return IRQ_HANDLED;
mutex_lock(&chip->play.lock);
if (atomic_read(&chip->play.fifo_status.written_done) == 1) {
status = &chip->play.fifo_status;
if (atomic_read(&status->written_done) == 1) {
/*
* Check the FIFO real time fill status before stopping
* play to make sure that all FIFO samples can be played
@ -2540,6 +2541,10 @@ static irqreturn_t fifo_empty_irq_handler(int irq, void *data)
goto unlock;
}
if (!chip->play.effect)
goto unlock;
fifo = chip->play.effect->fifo;
if (!fifo || !fifo->samples) {
dev_err(chip->dev, "no FIFO samples available\n");
goto unlock;