Commit 22695837 authored by Dan Carpenter's avatar Dan Carpenter Committed by Wolfram Sang
Browse files

i2c: cp2615: check for allocation failure in cp2615_i2c_recv() 



We need to add a check for if the kzalloc() fails.

Fixes: 4a769542 ("i2c: cp2615: add i2c driver for Silicon Labs' CP2615 Digital Audio Bridge")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarBence Csókás <bence98@sch.bme.hu>
Signed-off-by: default avatarWolfram Sang <wsa@kernel.org>
parent 065b6211

drivers/i2c/busses/i2c-cp2615.c

+10 −4
Original line number Diff line number Diff line
@@ -138,17 +138,23 @@ cp2615_i2c_send(struct usb_interface *usbif, struct cp2615_i2c_transfer *i2c_w) 
static int

cp2615_i2c_recv(struct usb_interface *usbif, unsigned char tag, void *buf)

{

	struct cp2615_iop_msg *msg = kzalloc(sizeof(*msg), GFP_KERNEL);

	struct cp2615_i2c_transfer_result *i2c_r = (struct cp2615_i2c_transfer_result *)&msg->data;

	struct usb_device *usbdev = interface_to_usbdev(usbif);

	int res = usb_bulk_msg(usbdev, usb_rcvbulkpipe(usbdev, IOP_EP_IN),

			       msg, sizeof(struct cp2615_iop_msg), NULL, 0);

	struct cp2615_iop_msg *msg;

	struct cp2615_i2c_transfer_result *i2c_r;

	int res;



	msg = kzalloc(sizeof(*msg), GFP_KERNEL);

	if (!msg)

		return -ENOMEM;



	res = usb_bulk_msg(usbdev, usb_rcvbulkpipe(usbdev, IOP_EP_IN), msg,

			   sizeof(struct cp2615_iop_msg), NULL, 0);

	if (res < 0) {

		kfree(msg);

		return res;

	}



	i2c_r = (struct cp2615_i2c_transfer_result *)&msg->data;

	if (msg->msg != htons(iop_I2cTransferResult) || i2c_r->tag != tag) {

		kfree(msg);

		return -EIO;