diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-09-12 14:41:48 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-09-12 14:41:48 -0700 |
| commit | e276155e6bfeab0302fd080435df9c1f6c806fac (patch) | |
| tree | 6cd40c004581a1f33f78ed65cb9486c708822ba2 | |
| parent | b86ba37927f07b91be6bb9ec5d643c81ef3b7c30 (diff) | |
| parent | 964eeebd3c844738cbd9147d02b0df6085ca77db (diff) | |
Merge "msm: ipa: ipa_usb: teth_prot and ttype validation"
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_clients/ipa_usb.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c index 293371b88ab9..8142a5923855 100644 --- a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c +++ b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c @@ -902,7 +902,7 @@ int ipa_usb_init_teth_prot(enum ipa_usb_teth_prot teth_prot, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || ((teth_prot == IPA_USB_RNDIS || teth_prot == IPA_USB_ECM) && teth_params == NULL) || ipa_usb_notify_cb == NULL || user_data == NULL) { @@ -1105,7 +1105,8 @@ static bool ipa3_usb_check_chan_params(struct ipa_usb_xdci_chan_params *params) params->xfer_scratch.depcmd_hi_addr); if (params->client >= IPA_CLIENT_MAX || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B || params->xfer_scratch.const_buffer_size < 1 || params->xfer_scratch.const_buffer_size > 31) { @@ -1369,7 +1370,7 @@ static int ipa3_usb_release_xdci_channel(u32 clnt_hdl, int result = 0; IPA_USB_DBG_LOW("entry\n"); - if (ttype > IPA_USB_TRANSPORT_MAX) { + if (ttype < 0 || ttype >= IPA_USB_TRANSPORT_MAX) { IPA_USB_ERR("bad parameter.\n"); return -EINVAL; } @@ -1473,7 +1474,8 @@ static bool ipa3_usb_check_connect_params( (params->teth_prot != IPA_USB_DIAG && (params->usb_to_ipa_xferrscidx < 0 || params->usb_to_ipa_xferrscidx > 127)) || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("Invalid params\n"); return false; } @@ -2177,7 +2179,7 @@ EXPORT_SYMBOL(ipa_usb_xdci_connect); static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot) { - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameter.\n"); return -EFAULT; } @@ -2367,7 +2369,7 @@ int ipa_usb_deinit_teth_prot(enum ipa_usb_teth_prot teth_prot) mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2553,7 +2555,7 @@ int ipa_usb_xdci_suspend(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2754,7 +2756,7 @@ int ipa_usb_xdci_resume(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; |