diff options
| author | Skylar Chang <chiaweic@codeaurora.org> | 2017-08-29 10:54:04 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-09-06 12:46:37 -0700 |
| commit | 964eeebd3c844738cbd9147d02b0df6085ca77db (patch) | |
| tree | b388e51bc2bb8ac742ef96a85dcc153073ee30d1 | |
| parent | b92b0cea6dd3680eebc780c7d4b8bf5928668d20 (diff) | |
msm: ipa: ipa_usb: teth_prot and ttype validation
Add input validation logic for accessing teth_prot and ttype
members.
Change-Id: I05780fb3b09616b7a9cf0c36f71e9f1e5e49f136
CRs-Fixed: 2091803
Acked-by: Ady Abraham <adya@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_clients/ipa_usb.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c index 293371b88ab9..8142a5923855 100644 --- a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c +++ b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c @@ -902,7 +902,7 @@ int ipa_usb_init_teth_prot(enum ipa_usb_teth_prot teth_prot, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || ((teth_prot == IPA_USB_RNDIS || teth_prot == IPA_USB_ECM) && teth_params == NULL) || ipa_usb_notify_cb == NULL || user_data == NULL) { @@ -1105,7 +1105,8 @@ static bool ipa3_usb_check_chan_params(struct ipa_usb_xdci_chan_params *params) params->xfer_scratch.depcmd_hi_addr); if (params->client >= IPA_CLIENT_MAX || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B || params->xfer_scratch.const_buffer_size < 1 || params->xfer_scratch.const_buffer_size > 31) { @@ -1369,7 +1370,7 @@ static int ipa3_usb_release_xdci_channel(u32 clnt_hdl, int result = 0; IPA_USB_DBG_LOW("entry\n"); - if (ttype > IPA_USB_TRANSPORT_MAX) { + if (ttype < 0 || ttype >= IPA_USB_TRANSPORT_MAX) { IPA_USB_ERR("bad parameter.\n"); return -EINVAL; } @@ -1473,7 +1474,8 @@ static bool ipa3_usb_check_connect_params( (params->teth_prot != IPA_USB_DIAG && (params->usb_to_ipa_xferrscidx < 0 || params->usb_to_ipa_xferrscidx > 127)) || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("Invalid params\n"); return false; } @@ -2177,7 +2179,7 @@ EXPORT_SYMBOL(ipa_usb_xdci_connect); static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot) { - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameter.\n"); return -EFAULT; } @@ -2367,7 +2369,7 @@ int ipa_usb_deinit_teth_prot(enum ipa_usb_teth_prot teth_prot) mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2553,7 +2555,7 @@ int ipa_usb_xdci_suspend(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2754,7 +2756,7 @@ int ipa_usb_xdci_resume(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; |