evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ipa: ipa_usb: teth_prot and ttype validation

Browse source 
Add input validation logic for accessing teth_prot and ttype
members.

Change-Id: I05780fb3b09616b7a9cf0c36f71e9f1e5e49f136
CRs-Fixed: 2091803
Acked-by: Ady Abraham <adya@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
This commit is contained in:
Skylar Chang 2017-08-29 10:54:04 -07:00 • committed by Gerrit - the friendly Code Review server
parent b92b0cea6d
commit 964eeebd3c
1 changed files with 10 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/platform/msm/ipa/ipa_clients/ipa_usb.c
View file

@ -902,7 +902,7 @@ int ipa_usb_init_teth_prot(enum ipa_usb_teth_prot teth_prot,
mutex_lock(&ipa3_usb_ctx->general_mutex); mutex_lock(&ipa3_usb_ctx->general_mutex);
IPA_USB_DBG_LOW("entry\n"); IPA_USB_DBG_LOW("entry\n");
if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE ||
((teth_prot == IPA_USB_RNDIS || teth_prot == IPA_USB_ECM) && ((teth_prot == IPA_USB_RNDIS || teth_prot == IPA_USB_ECM) &&
teth_params == NULL) || ipa_usb_notify_cb == NULL || teth_params == NULL) || ipa_usb_notify_cb == NULL ||
user_data == NULL) { user_data == NULL) {
@ -1105,7 +1105,8 @@ static bool ipa3_usb_check_chan_params(struct ipa_usb_xdci_chan_params *params)
params->xfer_scratch.depcmd_hi_addr); params->xfer_scratch.depcmd_hi_addr);
if (params->client >= IPA_CLIENT_MAX || if (params->client >= IPA_CLIENT_MAX ||
params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE || params->teth_prot < 0 ||
params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE ||
params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B || params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B ||
params->xfer_scratch.const_buffer_size < 1 || params->xfer_scratch.const_buffer_size < 1 ||
params->xfer_scratch.const_buffer_size > 31) { params->xfer_scratch.const_buffer_size > 31) {
@ -1369,7 +1370,7 @@ static int ipa3_usb_release_xdci_channel(u32 clnt_hdl,
int result = 0; int result = 0;
IPA_USB_DBG_LOW("entry\n"); IPA_USB_DBG_LOW("entry\n");
if (ttype > IPA_USB_TRANSPORT_MAX) { if (ttype < 0 || ttype >= IPA_USB_TRANSPORT_MAX) {
IPA_USB_ERR("bad parameter.\n"); IPA_USB_ERR("bad parameter.\n");
return -EINVAL; return -EINVAL;
} }
@ -1473,7 +1474,8 @@ static bool ipa3_usb_check_connect_params(
(params->teth_prot != IPA_USB_DIAG && (params->teth_prot != IPA_USB_DIAG &&
(params->usb_to_ipa_xferrscidx < 0 || (params->usb_to_ipa_xferrscidx < 0 ||
params->usb_to_ipa_xferrscidx > 127)) || params->usb_to_ipa_xferrscidx > 127)) ||
params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { params->teth_prot < 0 ||
params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
IPA_USB_ERR("Invalid params\n"); IPA_USB_ERR("Invalid params\n");
return false; return false;
} }
@ -2177,7 +2179,7 @@ EXPORT_SYMBOL(ipa_usb_xdci_connect);
static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot) static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot)
{ {
if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
IPA_USB_ERR("bad parameter.\n"); IPA_USB_ERR("bad parameter.\n");
return -EFAULT; return -EFAULT;
} }
@ -2367,7 +2369,7 @@ int ipa_usb_deinit_teth_prot(enum ipa_usb_teth_prot teth_prot)
mutex_lock(&ipa3_usb_ctx->general_mutex); mutex_lock(&ipa3_usb_ctx->general_mutex);
IPA_USB_DBG_LOW("entry\n"); IPA_USB_DBG_LOW("entry\n");
if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
IPA_USB_ERR("bad parameters.\n"); IPA_USB_ERR("bad parameters.\n");
result = -EINVAL; result = -EINVAL;
goto bad_params; goto bad_params;
@ -2553,7 +2555,7 @@ int ipa_usb_xdci_suspend(u32 ul_clnt_hdl, u32 dl_clnt_hdl,
mutex_lock(&ipa3_usb_ctx->general_mutex); mutex_lock(&ipa3_usb_ctx->general_mutex);
IPA_USB_DBG_LOW("entry\n"); IPA_USB_DBG_LOW("entry\n");
if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
IPA_USB_ERR("bad parameters.\n"); IPA_USB_ERR("bad parameters.\n");
result = -EINVAL; result = -EINVAL;
goto bad_params; goto bad_params;
@ -2754,7 +2756,7 @@ int ipa_usb_xdci_resume(u32 ul_clnt_hdl, u32 dl_clnt_hdl,
mutex_lock(&ipa3_usb_ctx->general_mutex); mutex_lock(&ipa3_usb_ctx->general_mutex);
IPA_USB_DBG_LOW("entry\n"); IPA_USB_DBG_LOW("entry\n");
if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) { if (teth_prot < 0 || teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
IPA_USB_ERR("bad parameters.\n"); IPA_USB_ERR("bad parameters.\n");
result = -EINVAL; result = -EINVAL;
goto bad_params; goto bad_params;