Merge "platform-drivers: msm: sps: improve robustness of SPS driver" into msm-3.0

drivers/platform/msm/sps/sps.c

@@ -1203,11 +1203,11 @@ exit_err:
 	mutex_unlock(&sps->lock);
 
 	if (result) {
+		if (bam != NULL) {
 			if (virt_addr != NULL)
 				iounmap(bam->props.virt_addr);
-
-		if (bam != NULL)
 			kfree(bam);
+		}
 
 		return result;
 	}

drivers/platform/msm/sps/sps_bam.c

@@ -634,9 +634,16 @@ void sps_bam_pipe_free(struct sps_bam *dev, u32 pipe_index)
 		SPS_ERR("Disconnect BAM 0x%x pipe %d with events pending",
 			BAM_ID(dev), pipe_index);
 
-		list_for_each_entry(sps_event, &pipe->sys.events_q, list) {
+		sps_event = list_entry((&pipe->sys.events_q)->next,
+				typeof(*sps_event), list);
+
+		while (&sps_event->list != (&pipe->sys.events_q)) {
+			struct sps_q_event *sps_event_delete = sps_event;
+
 			list_del(&sps_event->list);
-			kfree(sps_event);
+			sps_event = list_entry(sps_event->list.next,
+					typeof(*sps_event), list);
+			kfree(sps_event_delete);
 		}
 	}
 
@@ -1086,12 +1093,18 @@ int sps_bam_pipe_reg_event(struct sps_bam *dev,
 			continue;	/* No */
 
 		index = SPS_EVENT_INDEX(opt_event_table[n].event_id);
+		if (index < 0)
+			SPS_ERR("Negative event index: "
+			"BAM 0x%x pipe %d mode %d",
+			BAM_ID(dev), pipe_index, reg->mode);
+		else {
 			event_reg = &pipe->sys.event_regs[index];
 			event_reg->xfer_done = reg->xfer_done;
 			event_reg->callback = reg->callback;
 			event_reg->mode = reg->mode;
 			event_reg->user = reg->user;
 		}
+	}
 
 	return 0;
 }

drivers/platform/msm/sps/sps_dma.c

@@ -291,6 +291,11 @@ int sps_dma_device_init(u32 h)
 	dev->h = h;
 	dev->bam = sps_h2bam(h);
 
+	if (dev->bam == NULL) {
+		SPS_ERR("BAM-DMA BAM device is not found from the handle.");
+		goto exit_err;
+	}
+
 	/* Map the BAM DMA device into virtual space, if necessary */
 	props = &dev->bam->props;
 	dev->phys_addr = props->periph_phys_addr;

drivers/platform/msm/sps/sps_mem.c

@@ -131,6 +131,12 @@ int sps_mem_init(u32 pipemem_phys_base, u32 pipemem_size)
 #endif
 
 	pool = gen_pool_create(min_alloc_order, nid);
+
+	if (!pool) {
+		SPS_ERR("sps:Failed to create a new memory pool.\n");
+		return -ENOMEM;
+	}
+
 #ifndef CONFIG_SPS_SUPPORT_NDP_BAM
 	res = gen_pool_add(pool, (u32) iomem_virt, iomem_size, nid);
 	if (res)