evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: pcie: add the checking of userspace input length"

Browse source
This commit is contained in:
Linux Build Service Account 2017-03-04 02:56:18 -08:00 • committed by Gerrit - the friendly Code Review server
commit 62be936f95
1 changed files with 28 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

49
drivers/pci/host/pci-msm.c
View file

@ -2534,13 +2534,14 @@ static ssize_t msm_pcie_cmd_debug(struct file *file,
char str[MAX_MSG_LEN];
unsigned int testcase = 0;
int i;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
testcase = (testcase * 10) + (str[i] - '0');
if (!rc_sel)
@ -2569,13 +2570,14 @@ static ssize_t msm_pcie_set_rc_sel(struct file *file,
char str[MAX_MSG_LEN];
int i;
u32 new_rc_sel = 0;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
new_rc_sel = (new_rc_sel * 10) + (str[i] - '0');
if ((!new_rc_sel) || (new_rc_sel > rc_sel_max)) {
@ -2612,13 +2614,14 @@ static ssize_t msm_pcie_set_base_sel(struct file *file,
int i;
u32 new_base_sel = 0;
char *base_sel_name;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
new_base_sel = (new_base_sel * 10) + (str[i] - '0');
if (!new_base_sel || new_base_sel > 5) {
@ -2713,14 +2716,15 @@ static ssize_t msm_pcie_set_wr_offset(struct file *file,
unsigned long ret;
char str[MAX_MSG_LEN];
int i;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
wr_offset = 0;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
wr_offset = (wr_offset * 10) + (str[i] - '0');
pr_alert("PCIe: wr_offset is now 0x%x\n", wr_offset);
@ -2739,14 +2743,15 @@ static ssize_t msm_pcie_set_wr_mask(struct file *file,
unsigned long ret;
char str[MAX_MSG_LEN];
int i;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
wr_mask = 0;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
wr_mask = (wr_mask * 10) + (str[i] - '0');
pr_alert("PCIe: wr_mask is now 0x%x\n", wr_mask);
@ -2764,14 +2769,15 @@ static ssize_t msm_pcie_set_wr_value(struct file *file,
unsigned long ret;
char str[MAX_MSG_LEN];
int i;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
wr_value = 0;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
wr_value = (wr_value * 10) + (str[i] - '0');
pr_alert("PCIe: wr_value is now 0x%x\n", wr_value);
@ -2890,14 +2896,15 @@ static ssize_t msm_pcie_set_corr_counter_limit(struct file *file,
unsigned long ret;
char str[MAX_MSG_LEN];
int i;
u32 size = sizeof(str) < count ? sizeof(str) : count;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, sizeof(str));
memset(str, 0, size);
ret = copy_from_user(str, buf, size);
if (ret)
return -EFAULT;
corr_counter_limit = 0;
for (i = 0; i < sizeof(str) && (str[i] >= '0') && (str[i] <= '9'); ++i)
for (i = 0; i < size && (str[i] >= '0') && (str[i] <= '9'); ++i)
corr_counter_limit = (corr_counter_limit * 10) + (str[i] - '0');
pr_info("PCIe: corr_counter_limit is now %lu\n", corr_counter_limit);