From f0d2102bf138fc97919ae912c5832a8483db3d2d Mon Sep 17 00:00:00 2001 From: Fenglin Wu Date: Mon, 11 Jan 2021 08:07:02 +0800 Subject: [PATCH] input: qcom-hv-haptics: check playing effect pointer in IRQ handler When uploading a constant effect after stopping FIFO play, the effect pointer in haptics_play_info structure will be set to NULL. If there is any pending fifo-empty IRQ gets served after that, it will trigger a NULL pointer dereference issue. To avoid this, check the playing effect pointer before use it in the IRQ handler. Change-Id: Iacfea5e48d0a9519fa2c930ec821e395c43b6281 Signed-off-by: Fenglin Wu --- drivers/input/misc/qcom-hv-haptics.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/input/misc/qcom-hv-haptics.c b/drivers/input/misc/qcom-hv-haptics.c index 2a8fd50a0bb1..0eed6cadbec4 100644 --- a/drivers/input/misc/qcom-hv-haptics.c +++ b/drivers/input/misc/qcom-hv-haptics.c @@ -2500,8 +2500,8 @@ static int haptics_hw_init(struct haptics_chip *chip) static irqreturn_t fifo_empty_irq_handler(int irq, void *data) { struct haptics_chip *chip = data; - struct fifo_cfg *fifo = chip->play.effect->fifo; - struct fifo_play_status *status = &chip->play.fifo_status; + struct fifo_cfg *fifo; + struct fifo_play_status *status; u32 samples_left; u8 *samples, val; int rc, num; @@ -2515,7 +2515,8 @@ static irqreturn_t fifo_empty_irq_handler(int irq, void *data) return IRQ_HANDLED; mutex_lock(&chip->play.lock); - if (atomic_read(&chip->play.fifo_status.written_done) == 1) { + status = &chip->play.fifo_status; + if (atomic_read(&status->written_done) == 1) { /* * Check the FIFO real time fill status before stopping * play to make sure that all FIFO samples can be played @@ -2540,6 +2541,10 @@ static irqreturn_t fifo_empty_irq_handler(int irq, void *data) goto unlock; } + if (!chip->play.effect) + goto unlock; + + fifo = chip->play.effect->fifo; if (!fifo || !fifo->samples) { dev_err(chip->dev, "no FIFO samples available\n"); goto unlock;