From 964eeebd3c844738cbd9147d02b0df6085ca77db Mon Sep 17 00:00:00 2001 From: Skylar Chang Date: Tue, 29 Aug 2017 10:54:04 -0700 Subject: msm: ipa: ipa_usb: teth_prot and ttype validation Add input validation logic for accessing teth_prot and ttype members. Change-Id: I05780fb3b09616b7a9cf0c36f71e9f1e5e49f136 CRs-Fixed: 2091803 Acked-by: Ady Abraham Signed-off-by: Skylar Chang --- drivers/platform/msm/ipa/ipa_clients/ipa_usb.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c index 293371b88ab9..8142a5923855 100644 --- a/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c +++ b/drivers/platform/msm/ipa/ipa_clients/ipa_usb.c @@ -902,7 +902,7 @@ int ipa_usb_init_teth_prot(enum ipa_usb_teth_prot teth_prot, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || ((teth_prot == IPA_USB_RNDIS || teth_prot == IPA_USB_ECM) && teth_params == NULL) || ipa_usb_notify_cb == NULL || user_data == NULL) { @@ -1105,7 +1105,8 @@ static bool ipa3_usb_check_chan_params(struct ipa_usb_xdci_chan_params *params) params->xfer_scratch.depcmd_hi_addr); if (params->client >= IPA_CLIENT_MAX || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE || params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B || params->xfer_scratch.const_buffer_size < 1 || params->xfer_scratch.const_buffer_size > 31) { @@ -1369,7 +1370,7 @@ static int ipa3_usb_release_xdci_channel(u32 clnt_hdl, int result = 0; IPA_USB_DBG_LOW("entry\n"); - if (ttype > IPA_USB_TRANSPORT_MAX) { + if (ttype < 0 || ttype >= IPA_USB_TRANSPORT_MAX) { IPA_USB_ERR("bad parameter.\n"); return -EINVAL; } @@ -1473,7 +1474,8 @@ static bool ipa3_usb_check_connect_params( (params->teth_prot != IPA_USB_DIAG && (params->usb_to_ipa_xferrscidx < 0 || params->usb_to_ipa_xferrscidx > 127)) || - params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + params->teth_prot < 0 || + params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("Invalid params\n"); return false; } @@ -2177,7 +2179,7 @@ EXPORT_SYMBOL(ipa_usb_xdci_connect); static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot) { - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameter.\n"); return -EFAULT; } @@ -2367,7 +2369,7 @@ int ipa_usb_deinit_teth_prot(enum ipa_usb_teth_prot teth_prot) mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2553,7 +2555,7 @@ int ipa_usb_xdci_suspend(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; @@ -2754,7 +2756,7 @@ int ipa_usb_xdci_resume(u32 ul_clnt_hdl, u32 dl_clnt_hdl, mutex_lock(&ipa3_usb_ctx->general_mutex); IPA_USB_DBG_LOW("entry\n"); - if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { + if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) { IPA_USB_ERR("bad parameters.\n"); result = -EINVAL; goto bad_params; -- cgit v1.2.3