diff options
author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-05-25 15:52:01 -0700 |
---|---|---|
committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-05-25 15:52:00 -0700 |
commit | e2a2179d4e5b32be9fbb60fa59efdf6fd0d939e4 (patch) | |
tree | 53ae292d15d0f0c71cca4fd4a037c569f10094af | |
parent | 09173073cfbc3e4196f400b2cd0ffbaba4670ebf (diff) | |
parent | ab15752d1c385f65ba4fb30ebe50974891add67c (diff) |
Merge "spcom: check error from ion_import_dma_buf()"
-rw-r--r-- | drivers/soc/qcom/spcom.c | 25 |
1 files changed, 16 insertions, 9 deletions
diff --git a/drivers/soc/qcom/spcom.c b/drivers/soc/qcom/spcom.c index 8b2dc14b2400..0e1e4ae975b0 100644 --- a/drivers/soc/qcom/spcom.c +++ b/drivers/soc/qcom/spcom.c @@ -121,7 +121,7 @@ /* * After both sides get CONNECTED, - * there is a race between once side queueing rx buffer and the other side + * there is a race between once side queuing rx buffer and the other side * trying to call glink_tx() , this race is only on the 1st tx. * do tx retry with some delay to allow the other side to queue rx buffer. */ @@ -138,7 +138,7 @@ /* * ACK timeout from remote side for TX data. - * Normally, it takes few msec for SPSS to responde with ACK for TX data. + * Normally, it takes few msec for SPSS to respond with ACK for TX data. * However, due to SPSS HW issue, the SPSS might disable interrupts * for a very long time. */ @@ -364,7 +364,7 @@ static void spcom_link_state_notif_cb(struct glink_link_state_cb_info *cb_info, const char *ch_name = "sp_kernel"; if (!cb_info) { - pr_err("invalid NULL cb_info.\n"); + pr_err("invalid NULL cb_info param\n"); return; } @@ -1482,6 +1482,7 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) int ret = 0; struct spcom_user_create_channel_command *cmd = cmd_buf; const char *ch_name; + const size_t maxlen = sizeof(cmd->ch_name); if (cmd_size != sizeof(*cmd)) { pr_err("cmd_size [%d] , expected [%d].\n", @@ -1490,6 +1491,10 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size) } ch_name = cmd->ch_name; + if (strnlen(cmd->ch_name, maxlen) == maxlen) { + pr_err("channel name is not NULL terminated\n"); + return -EINVAL; + } pr_debug("ch_name [%s].\n", ch_name); @@ -1628,7 +1633,7 @@ static int modify_ion_addr(void *buf, /* Get ION handle from fd */ handle = ion_import_dma_buf(spcom_dev->ion_client, fd); - if (handle == NULL) { + if (IS_ERR_OR_NULL(handle)) { pr_err("fail to get ion handle.\n"); return -EINVAL; } @@ -1789,7 +1794,7 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch, /* Get ION handle from fd - this increments the ref count */ ion_handle = ion_import_dma_buf(spcom_dev->ion_client, fd); - if (ion_handle == NULL) { + if (IS_ERR_OR_NULL(ion_handle)) { pr_err("fail to get ion handle.\n"); return -EINVAL; } @@ -1867,6 +1872,8 @@ static int spcom_unlock_ion_buf(struct spcom_channel *ch, int fd) } else { /* unlock specific ION buf */ for (i = 0 ; i < ARRAY_SIZE(ch->ion_handle_table) ; i++) { + if (ch->ion_handle_table[i] == NULL) + continue; if (ch->ion_fd_table[i] == fd) { pr_debug("unlocked ion buf #%d fd [%d].\n", i, ch->ion_fd_table[i]); @@ -1934,9 +1941,9 @@ static int spcom_handle_write(struct spcom_channel *ch, int swap_id; char cmd_name[5] = {0}; /* debug only */ - /* opcode field is the minimum length of cmd */ - if (buf_size < sizeof(cmd->cmd_id)) { - pr_err("Invalid argument user buffer size %d.\n", buf_size); + /* Minimal command should have command-id and argument */ + if (buf_size < sizeof(struct spcom_user_command)) { + pr_err("Command buffer size [%d] too small\n", buf_size); return -EINVAL; } @@ -2026,7 +2033,7 @@ static int spcom_handle_read_req_resp(struct spcom_channel *ch, /* Check param validity */ if (size > SPCOM_MAX_RESPONSE_SIZE) { - pr_err("ch [%s] inavlid size [%d].\n", + pr_err("ch [%s] invalid size [%d].\n", ch->name, size); return -EINVAL; } |