Message ID | 20220624155413.399190-1-fabrice.gasnier@foss.st.com |
---|---|
Headers | show |
Series | usb: typec: ucsi: add support for stm32g0 | expand |
Le 24/06/2022 à 17:54, Fabrice Gasnier a écrit : > STM32G0 provides an integrated USB Type-C and power delivery interface. > It can be programmed with a firmware to handle UCSI protocol over I2C > interface. A GPIO is used as an interrupt line. > > Signed-off-by: Fabrice Gasnier <fabrice.gasnier-rj0Iel/JR4NBDgjK7y7TUQ@public.gmane.org> > --- > drivers/usb/typec/ucsi/Kconfig | 10 ++ > drivers/usb/typec/ucsi/Makefile | 1 + > drivers/usb/typec/ucsi/ucsi_stm32g0.c | 218 ++++++++++++++++++++++++++ > 3 files changed, 229 insertions(+) > create mode 100644 drivers/usb/typec/ucsi/ucsi_stm32g0.c > [...] > +static int ucsi_stm32g0_async_write(struct ucsi *ucsi, unsigned int offset, const void *val, > + size_t len) > +{ > + struct ucsi_stm32g0 *g0 = ucsi_get_drvdata(ucsi); > + struct i2c_client *client = g0->client; > + struct i2c_msg msg[] = { > + { > + .addr = client->addr, > + .flags = 0, > + } > + }; > + unsigned char *buf; > + int ret; > + > + buf = kzalloc(len + 1, GFP_KERNEL); Hi, Nit: kmalloc() would be enough here, the whole buffer is written just a few lines after. > + if (!buf) > + return -ENOMEM; > + > + buf[0] = offset; > + memcpy(&buf[1], val, len); > + msg[0].len = len + 1; > + msg[0].buf = buf; > + > + ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg)); > + kfree(buf); > + if (ret != ARRAY_SIZE(msg)) { > + dev_err(g0->dev, "i2c write %02x, %02x error: %d\n", client->addr, buf[0], ret); Use-after-free of buf. > + > + return ret < 0 ? ret : -EIO; > + } > + > + return 0; > +} > + Just my 2c, CJ [...]