Merge "msm: ipa: ipa_usb: teth_prot and ttype validation" (2ce839c6) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/platform/msm/ipa/ipa_clients/ipa_usb.c

+15 −13

Original line number	Diff line number	Diff line
		@@ -785,7 +785,7 @@ int ipa_usb_init_teth_prot(enum ipa_usb_teth_prot teth_prot,

		mutex_lock(&ipa3_usb_ctx->general_mutex);
		IPA_USB_DBG_LOW("entry\n");
		if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE \|\|
		if (teth_prot < 0 \|\| teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE \|\|
		((teth_prot == IPA_USB_RNDIS \|\| teth_prot == IPA_USB_ECM) &&
		teth_params == NULL) \|\| ipa_usb_notify_cb == NULL \|\|
		user_data == NULL) {
		@@ -986,7 +986,8 @@ static bool ipa3_usb_check_chan_params(struct ipa_usb_xdci_chan_params *params)
		params->xfer_scratch.depcmd_hi_addr);

		if (params->client >= IPA_CLIENT_MAX \|\|
		params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE \|\|
		params->teth_prot < 0 \|\|
		params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE \|\|
		params->xfer_ring_len % GSI_CHAN_RE_SIZE_16B \|\|
		params->xfer_scratch.const_buffer_size < 1 \|\|
		params->xfer_scratch.const_buffer_size > 31) {
		@@ -1245,8 +1246,8 @@ static int ipa3_usb_release_xdci_channel(u32 clnt_hdl,
		int result = 0;

		IPA_USB_DBG_LOW("entry\n");
		if (ttype > IPA_USB_TRANSPORT_MAX) {
		IPA_USB_ERR("bad parameter\n");
		if (ttype < 0 \|\| ttype >= IPA_USB_TRANSPORT_MAX) {
		IPA_USB_ERR("bad parameter.\n");
		return -EINVAL;
		}

		@@ -1347,7 +1348,8 @@ static bool ipa3_usb_check_connect_params(
		params->ipa_to_usb_xferrscidx > 127 \|\|
		(params->teth_prot != IPA_USB_DIAG &&
		(params->usb_to_ipa_xferrscidx > 127)) \|\|
		params->teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) {
		params->teth_prot < 0 \|\|
		params->teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("Invalid params\n");
		return false;
		}
		@@ -2046,8 +2048,8 @@ EXPORT_SYMBOL(ipa_usb_xdci_connect);

		static int ipa3_usb_check_disconnect_prot(enum ipa_usb_teth_prot teth_prot)
		{
		if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameter\n");
		if (teth_prot < 0 \|\| teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameter.\n");
		return -EFAULT;
		}

		@@ -2235,8 +2237,8 @@ int ipa_usb_deinit_teth_prot(enum ipa_usb_teth_prot teth_prot)

		mutex_lock(&ipa3_usb_ctx->general_mutex);
		IPA_USB_DBG_LOW("entry\n");
		if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters\n");
		if (teth_prot < 0 \|\| teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters.\n");
		result = -EINVAL;
		goto bad_params;
		}
		@@ -2415,8 +2417,8 @@ int ipa_usb_xdci_suspend(u32 ul_clnt_hdl, u32 dl_clnt_hdl,
		mutex_lock(&ipa3_usb_ctx->general_mutex);
		IPA_USB_DBG_LOW("entry\n");

		if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters\n");
		if (teth_prot < 0 \|\| teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters.\n");
		result = -EINVAL;
		goto bad_params;
		}
		@@ -2587,8 +2589,8 @@ int ipa_usb_xdci_resume(u32 ul_clnt_hdl, u32 dl_clnt_hdl,
		mutex_lock(&ipa3_usb_ctx->general_mutex);
		IPA_USB_DBG_LOW("entry\n");

		if (teth_prot > IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters\n");
		if (teth_prot < 0 \|\| teth_prot >= IPA_USB_MAX_TETH_PROT_SIZE) {
		IPA_USB_ERR("bad parameters.\n");
		result = -EINVAL;
		goto bad_params;
		}