bridge: fix a possible use after free
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / drivers / firmware / sigma.c
blobf10fc521951b17491348f0cd0fbb1f3013e31eae
1 /*
2 * Load Analog Devices SigmaStudio firmware files
4 * Copyright 2009-2011 Analog Devices Inc.
6 * Licensed under the GPL-2 or later.
7 */
9 #include <linux/crc32.h>
10 #include <linux/delay.h>
11 #include <linux/firmware.h>
12 #include <linux/kernel.h>
13 #include <linux/i2c.h>
14 #include <linux/module.h>
15 #include <linux/sigma.h>
17 /* Return: 0==OK, <0==error, =1 ==no more actions */
18 static int
19 process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
21 struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos);
22 size_t len = sigma_action_len(sa);
23 int ret = 0;
25 pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__,
26 sa->instr, sa->addr, len);
28 switch (sa->instr) {
29 case SIGMA_ACTION_WRITEXBYTES:
30 case SIGMA_ACTION_WRITESINGLE:
31 case SIGMA_ACTION_WRITESAFELOAD:
32 if (ssfw->fw->size < ssfw->pos + len)
33 return -EINVAL;
34 ret = i2c_master_send(client, (void *)&sa->addr, len);
35 if (ret < 0)
36 return -EINVAL;
37 break;
39 case SIGMA_ACTION_DELAY:
40 ret = 0;
41 udelay(len);
42 len = 0;
43 break;
45 case SIGMA_ACTION_END:
46 return 1;
48 default:
49 return -EINVAL;
52 /* when arrive here ret=0 or sent data */
53 ssfw->pos += sigma_action_size(sa, len);
54 return ssfw->pos == ssfw->fw->size;
57 static int
58 process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw)
60 pr_debug("%s: processing %p\n", __func__, ssfw);
62 while (1) {
63 int ret = process_sigma_action(client, ssfw);
64 pr_debug("%s: action returned %i\n", __func__, ret);
65 if (ret == 1)
66 return 0;
67 else if (ret)
68 return ret;
72 int process_sigma_firmware(struct i2c_client *client, const char *name)
74 int ret;
75 struct sigma_firmware_header *ssfw_head;
76 struct sigma_firmware ssfw;
77 const struct firmware *fw;
78 u32 crc;
80 pr_debug("%s: loading firmware %s\n", __func__, name);
82 /* first load the blob */
83 ret = request_firmware(&fw, name, &client->dev);
84 if (ret) {
85 pr_debug("%s: request_firmware() failed with %i\n", __func__, ret);
86 return ret;
88 ssfw.fw = fw;
90 /* then verify the header */
91 ret = -EINVAL;
92 if (fw->size < sizeof(*ssfw_head))
93 goto done;
95 ssfw_head = (void *)fw->data;
96 if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic)))
97 goto done;
99 crc = crc32(0, fw->data, fw->size);
100 pr_debug("%s: crc=%x\n", __func__, crc);
101 if (crc != ssfw_head->crc)
102 goto done;
104 ssfw.pos = sizeof(*ssfw_head);
106 /* finally process all of the actions */
107 ret = process_sigma_actions(client, &ssfw);
109 done:
110 release_firmware(fw);
112 pr_debug("%s: loaded %s\n", __func__, name);
114 return ret;
116 EXPORT_SYMBOL(process_sigma_firmware);
118 MODULE_LICENSE("GPL");