msm: ipa3: Validate IPA client mapping to endpoint index

ipa3_get_ep_mapping() is used to map an IPA client to
IPA endpoint index. The index is used as array index.
This change validates that the returned index is
within the valid range.

CRs-fixed: 2012203
Change-Id: I25df8d0c9b60a5290f2457dd2ed77f2c7e78b46f
Signed-off-by: Ghanim Fodi <gfodi@codeaurora.org>

drivers/platform/msm/ipa/ipa_v3/ipa_dma.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -853,6 +853,10 @@ void ipa3_dma_async_memcpy_notify_cb(void *priv
 
 	mem_info = (struct ipa_mem_buffer *)data;
 	ep_idx = ipa3_get_ep_mapping(IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS);
+	if (ep_idx < 0) {
+		IPADMA_ERR("IPA Client mapping failed\n");
+		return;
+	}
 	sys = ipa3_ctx->ep[ep_idx].sys;
 
 	spin_lock_irqsave(&ipa3_dma_ctx->async_lock, flags);

drivers/platform/msm/ipa/ipa_v3/ipa_flt.c

@@ -14,7 +14,6 @@
 #include "ipahal/ipahal.h"
 #include "ipahal/ipahal_fltrt.h"
 
-#define IPA_FLT_TABLE_INDEX_NOT_FOUND		(-1)
 #define IPA_FLT_STATUS_OF_ADD_FAILED		(-1)
 #define IPA_FLT_STATUS_OF_DEL_FAILED		(-1)
 #define IPA_FLT_STATUS_OF_MDFY_FAILED		(-1)
@@ -1001,7 +1000,7 @@ error:
 static int __ipa_add_flt_get_ep_idx(enum ipa_client_type ep, int *ipa_ep_idx)
 {
 	*ipa_ep_idx = ipa3_get_ep_mapping(ep);
-	if (*ipa_ep_idx == IPA_FLT_TABLE_INDEX_NOT_FOUND) {
+	if (*ipa_ep_idx < 0) {
 		IPAERR("ep not valid ep=%d\n", ep);
 		return -EINVAL;
 	}

drivers/platform/msm/ipa/ipa_v3/ipa_mhi.c

@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, 2016 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2015, 2017 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -153,10 +153,16 @@ int ipa3_mhi_reset_channel_internal(enum ipa_client_type client)
 int ipa3_mhi_start_channel_internal(enum ipa_client_type client)
 {
 	int res;
+	int ipa_ep_idx;
 
 	IPA_MHI_FUNC_ENTRY();
 
-	res = ipa3_enable_data_path(ipa3_get_ep_mapping(client));
+	ipa_ep_idx = ipa3_get_ep_mapping(client);
+	if (ipa_ep_idx < 0) {
+		IPA_MHI_ERR("Invalid client %d\n", client);
+		return -EINVAL;
+	}
+	res = ipa3_enable_data_path(ipa_ep_idx);
 	if (res) {
 		IPA_MHI_ERR("ipa3_enable_data_path failed %d\n", res);
 		return res;
@@ -521,6 +527,10 @@ int ipa3_mhi_resume_channels_internal(enum ipa_client_type client,
 	IPA_MHI_FUNC_ENTRY();
 
 	ipa_ep_idx = ipa3_get_ep_mapping(client);
+	if (ipa_ep_idx < 0) {
+		IPA_MHI_ERR("Invalid client %d\n", client);
+		return -EINVAL;
+	}
 	ep = &ipa3_ctx->ep[ipa_ep_idx];
 
 	if (brstmode_enabled && !LPTransitionRejected) {
@@ -557,11 +567,14 @@ int ipa3_mhi_query_ch_info(enum ipa_client_type client,
 	IPA_MHI_FUNC_ENTRY();
 
 	ipa_ep_idx = ipa3_get_ep_mapping(client);
-
+	if (ipa_ep_idx < 0) {
+		IPA_MHI_ERR("Invalid client %d\n", client);
+		return -EINVAL;
+	}
 	ep = &ipa3_ctx->ep[ipa_ep_idx];
 	res = gsi_query_channel_info(ep->gsi_chan_hdl, ch_info);
 	if (res) {
-		IPAERR("gsi_query_channel_info failed\n");
+		IPA_MHI_ERR("gsi_query_channel_info failed\n");
 		return res;
 	}
 
@@ -596,7 +609,10 @@ int ipa3_mhi_destroy_channel(enum ipa_client_type client)
 	struct ipa3_ep_context *ep;
 
 	ipa_ep_idx = ipa3_get_ep_mapping(client);
-
+	if (ipa_ep_idx < 0) {
+		IPA_MHI_ERR("Invalid client %d\n", client);
+		return -EINVAL;
+	}
 	ep = &ipa3_ctx->ep[ipa_ep_idx];
 
 	IPA_MHI_DBG("reset event ring (hdl: %lu, ep: %d)\n",

drivers/platform/msm/ipa/ipa_v3/ipa_utils.c

@@ -929,7 +929,7 @@ int ipa3_get_ep_mapping(enum ipa_client_type client)
 
 	if (client >= IPA_CLIENT_MAX || client < 0) {
 		IPAERR("Bad client number! client =%d\n", client);
-		return -EINVAL;
+		return IPA_EP_NOT_ALLOCATED;
 	}
 
 	ipa_ep_idx = ipa3_ep_mapping[ipa3_get_hw_type_index()][client].pipe_num;
@@ -3446,6 +3446,11 @@ void ipa3_suspend_apps_pipes(bool suspend)
 	cfg.ipa_ep_suspend = suspend;
 
 	ipa_ep_idx = ipa3_get_ep_mapping(IPA_CLIENT_APPS_LAN_CONS);
+	if (ipa_ep_idx < 0) {
+		IPAERR("IPA client mapping failed\n");
+		ipa_assert();
+		return;
+	}
 	ep = &ipa3_ctx->ep[ipa_ep_idx];
 	if (ep->valid) {
 		IPADBG("%s pipe %d\n", suspend ? "suspend" : "unsuspend",