diff options
| author | Ghanim Fodi <gfodi@codeaurora.org> | 2016-08-02 14:56:28 +0300 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-08-07 03:38:03 -0700 |
| commit | 7a9dd3df64715ec92051466e95fe4f2c43d7ab79 (patch) | |
| tree | 909533d540a7c9b7baa23db14392098cecb73753 /drivers/platform/msm | |
| parent | 28352998dee80f33641dd7b28479350bd480b823 (diff) | |
msm: ipa: Add parameters validation to handle static analysis issues
Check input parameter range before using it to access
array elements and check pointer value before
dereferencing it.
Change-Id: I702b4ff11582047b00e3f0d5433d29c84f34e913
CRs-Fixed: 1048706
Signed-off-by: Ghanim Fodi <gfodi@codeaurora.org>
Diffstat (limited to 'drivers/platform/msm')
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c | 16 | ||||
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c | 5 |
2 files changed, 21 insertions, 0 deletions
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c index 6c4d14b093c3..bcd2cb3bfd7a 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c @@ -535,6 +535,11 @@ static int ipahal_imm_cmd_init(enum ipa_hw_type ipa_hw_type) IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type); + if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) { + IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type); + return -EINVAL; + } + memset(&zero_obj, 0, sizeof(zero_obj)); for (i = IPA_HW_v3_0 ; i < ipa_hw_type ; i++) { for (j = 0; j < IPA_IMM_CMD_MAX ; j++) { @@ -901,6 +906,11 @@ static int ipahal_pkt_status_init(enum ipa_hw_type ipa_hw_type) IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type); + if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) { + IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type); + return -EINVAL; + } + /* * Since structure alignment is implementation dependent, * add test to avoid different and incompatible data layouts. @@ -1269,6 +1279,12 @@ int ipahal_init(enum ipa_hw_type ipa_hw_type, void __iomem *base, goto bail_free_ctx; } + if (ipa_hw_type >= IPA_HW_MAX) { + IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type); + result = -EINVAL; + goto bail_free_ctx; + } + if (!base) { IPAHAL_ERR("invalid memory io mapping addr\n"); result = -EINVAL; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c index c47d353d9658..a3345d7ac305 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c @@ -1066,6 +1066,11 @@ int ipahal_reg_init(enum ipa_hw_type ipa_hw_type) IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type); + if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) { + IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type); + return -EINVAL; + } + memset(&zero_obj, 0, sizeof(zero_obj)); for (i = IPA_HW_v3_0 ; i < ipa_hw_type ; i++) { for (j = 0; j < IPA_REG_MAX ; j++) { |