Merge "spcom: check error from ion_import_dma_buf()"

drivers/soc/qcom/spcom.c

@@ -121,7 +121,7 @@
 
 /*
  * After both sides get CONNECTED,
- * there is a race between once side queueing rx buffer and the other side
+ * there is a race between once side queuing rx buffer and the other side
  * trying to call glink_tx() , this race is only on the 1st tx.
  * do tx retry with some delay to allow the other side to queue rx buffer.
  */
@@ -138,7 +138,7 @@
 
 /*
  * ACK timeout from remote side for TX data.
- * Normally, it takes few msec for SPSS to responde with ACK for TX data.
+ * Normally, it takes few msec for SPSS to respond with ACK for TX data.
  * However, due to SPSS HW issue, the SPSS might disable interrupts
  * for a very long time.
  */
@@ -364,7 +364,7 @@ static void spcom_link_state_notif_cb(struct glink_link_state_cb_info *cb_info,
 	const char *ch_name = "sp_kernel";
 
 	if (!cb_info) {
-		pr_err("invalid NULL cb_info.\n");
+		pr_err("invalid NULL cb_info param\n");
 		return;
 	}
 
@@ -1482,6 +1482,7 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size)
 	int ret = 0;
 	struct spcom_user_create_channel_command *cmd = cmd_buf;
 	const char *ch_name;
+	const size_t maxlen = sizeof(cmd->ch_name);
 
 	if (cmd_size != sizeof(*cmd)) {
 		pr_err("cmd_size [%d] , expected [%d].\n",
@@ -1490,6 +1491,10 @@ static int spcom_handle_create_channel_command(void *cmd_buf, int cmd_size)
 	}
 
 	ch_name = cmd->ch_name;
+	if (strnlen(cmd->ch_name, maxlen) == maxlen) {
+		pr_err("channel name is not NULL terminated\n");
+		return -EINVAL;
+	}
 
 	pr_debug("ch_name [%s].\n", ch_name);
 
@@ -1628,7 +1633,7 @@ static int modify_ion_addr(void *buf,
 
 	/* Get ION handle from fd */
 	handle = ion_import_dma_buf(spcom_dev->ion_client, fd);
-	if (handle == NULL) {
+	if (IS_ERR_OR_NULL(handle)) {
 		pr_err("fail to get ion handle.\n");
 		return -EINVAL;
 	}
@@ -1789,7 +1794,7 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch,
 
 	/* Get ION handle from fd - this increments the ref count */
 	ion_handle = ion_import_dma_buf(spcom_dev->ion_client, fd);
-	if (ion_handle == NULL) {
+	if (IS_ERR_OR_NULL(ion_handle)) {
 		pr_err("fail to get ion handle.\n");
 		return -EINVAL;
 	}
@@ -1867,6 +1872,8 @@ static int spcom_unlock_ion_buf(struct spcom_channel *ch, int fd)
 	} else {
 		/* unlock specific ION buf */
 		for (i = 0 ; i < ARRAY_SIZE(ch->ion_handle_table) ; i++) {
+			if (ch->ion_handle_table[i] == NULL)
+				continue;
 			if (ch->ion_fd_table[i] == fd) {
 				pr_debug("unlocked ion buf #%d fd [%d].\n",
 					i, ch->ion_fd_table[i]);
@@ -1934,9 +1941,9 @@ static int spcom_handle_write(struct spcom_channel *ch,
 	int swap_id;
 	char cmd_name[5] = {0}; /* debug only */
 
-	/* opcode field is the minimum length of cmd */
-	if (buf_size < sizeof(cmd->cmd_id)) {
-		pr_err("Invalid argument user buffer size %d.\n", buf_size);
+	/* Minimal command should have command-id and argument */
+	if (buf_size < sizeof(struct spcom_user_command)) {
+		pr_err("Command buffer size [%d] too small\n", buf_size);
 		return -EINVAL;
 	}
 
@@ -2026,7 +2033,7 @@ static int spcom_handle_read_req_resp(struct spcom_channel *ch,
 
 	/* Check param validity */
 	if (size > SPCOM_MAX_RESPONSE_SIZE) {
-		pr_err("ch [%s] inavlid size [%d].\n",
+		pr_err("ch [%s] invalid size [%d].\n",
 			ch->name, size);
 		return -EINVAL;
 	}