path: root/drivers/rpmsg
diff options
authorColin Ian King <colin.king@canonical.com>2017-09-03 13:46:14 +0100
committerBjorn Andersson <bjorn.andersson@linaro.org>2017-09-04 10:51:49 -0700
commit906cf29cfab5806d32c2a274f86f3d076c0a48be (patch)
treee41dbbb37489e0b0e0981239aba71e9b78eb7f4e /drivers/rpmsg
parent2b41d6c8e6967b4243e5b721aa4d778eb6f7d4e7 (diff)
rpmsg: glink: fix null pointer dereference on a null intent
In the case where glink->intentless is true and the call to qcom_glink_tx fails then we have a condition where ret is non-zero and intent is null, causing a null pointer deference when setting intent->in_use to false. Add an extra check to only dereference intent if intent is non-null. Detected by: CoverityScan CID#1455247 ("Explicit null dereferenced") Fixes: 88c6060f5a7f ("rpmsg: glink: Handle remote rx done command") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Diffstat (limited to 'drivers/rpmsg')
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 666068202597..8bc0d0456a40 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -1264,7 +1264,7 @@ static int __qcom_glink_send(struct glink_channel *channel,
ret = qcom_glink_tx(glink, &req, sizeof(req), data, len, wait);
/* Mark intent available if we failed */
- if (ret)
+ if (ret && intent)
intent->in_use = false;
return ret;

Privacy Policy