Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1cb8065c authored by Gilad Broner's avatar Gilad Broner
Browse files

media: dvb: check for ion mapping errors 



Mapping a linear buffer allocated using ion to kernel space might
result in an error other than NULL pointer. Current code only checked
for NULL so errors can go undetected as a valid buffer mapping.

Change-Id: I3d0af279b6ac0d6cc1689ba910ebb5c9d4a0a872
Signed-off-by: default avatarGilad Broner <gbroner@codeaurora.org>
parent 1f8da54f

drivers/media/platform/msm/dvb/demux/mpq_dmx_plugin_common.c

+14 −8
Original line number Diff line number Diff line
@@ -934,9 +934,11 @@ static int mpq_map_buffer_to_kernel( 
	} else {

		unsigned long tmp;

		*kernel_mem = ion_map_kernel(client, ion_handle);

		if (*kernel_mem == NULL) {

			MPQ_DVB_ERR_PRINT("%s: ion_map_kernel failed\n",

				__func__);

		if (IS_ERR_OR_NULL(*kernel_mem)) {

			ret = PTR_ERR(*kernel_mem);

			MPQ_DVB_ERR_PRINT("%s: ion_map_kernel failed, ret=%d\n",

				__func__, ret);

			if (!ret)

				ret = -ENOMEM;

			goto map_buffer_failed_free_buff;

		}
@@ -3527,15 +3529,19 @@ static int mpq_sdmx_get_buffer_chunks(struct mpq_demux *mpq_demux, 
	struct sg_table *sg_ptr;

	struct scatterlist *sg;

	u32 chunk_size;

	int ret;



	memset(buff_chunks, 0,

		sizeof(struct sdmx_buff_descr) * SDMX_MAX_PHYSICAL_CHUNKS);



	sg_ptr = ion_sg_table(mpq_demux->ion_client, buff_handle);

	if (sg_ptr == NULL) {

		MPQ_DVB_ERR_PRINT("%s: ion_sg_table failed\n",

			__func__);

		return -EINVAL;

	if (IS_ERR_OR_NULL(sg_ptr)) {

		ret = PTR_ERR(sg_ptr);

		MPQ_DVB_ERR_PRINT("%s: ion_sg_table failed, ret=%d\n",

			__func__, ret);

		if (!ret)

			ret = -EINVAL;

		return ret;

	}



	if (sg_ptr->nents == 0) {