From 5720ed5c3a786e3ba0a2428ac45da5d7ec996b4e Mon Sep 17 00:00:00 2001 From: Gopikrishnaiah Anandan Date: Fri, 16 Aug 2013 17:34:21 -0400 Subject: Soc: msm: qdsp6v2: Fix invalid params handling Alloc and free apis should sanity check all input params. If allocation fails set client and ion handle to NULL. Change-Id: Ide3bd782eb90ee8b033e39de232929a1ca7174b7 Signed-off-by: Gopikrishnaiah Anandan --- arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c b/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c index 0c71659..f9e9d6d 100644 --- a/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c +++ b/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c @@ -53,7 +53,11 @@ int msm_audio_ion_alloc(const char *name, struct ion_client **client, pr_debug("%s:probe is not done, deferred\n", __func__); return -EPROBE_DEFER; } - + if (!name || !client || !handle || !paddr || !vaddr + || !bufsz || !pa_len) { + pr_err("%s: Invalid params\n", __func__); + return -EINVAL; + } *client = msm_audio_ion_client_create(UINT_MAX, name); if (IS_ERR_OR_NULL((void *)(*client))) { pr_err("%s: ION create client for AUDIO failed\n", __func__); @@ -102,9 +106,9 @@ int msm_audio_ion_alloc(const char *name, struct ion_client **client, err_ion_handle: ion_free(*client, *handle); - *handle = NULL; err_ion_client: msm_audio_ion_client_destroy(*client); + *handle = NULL; *client = NULL; err: return -EINVAL; @@ -116,10 +120,17 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, ion_phys_addr_t *paddr, size_t *pa_len, void **vaddr) { int rc = 0; + if (!name || !client || !handle || !ionflag || !paddr || !vaddr + || !bufsz || !pa_len) { + pr_err("%s: Invalid params\n", __func__); + rc = -EINVAL; + goto err; + } *client = msm_audio_ion_client_create(UINT_MAX, name); if (IS_ERR_OR_NULL((void *)(*client))) { pr_err("%s: ION create client for AUDIO failed\n", __func__); + rc = -EINVAL; goto err; } @@ -132,8 +143,9 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, if (IS_ERR_OR_NULL((void *) (*handle))) { pr_err("%s: ion import dma buffer failed\n", __func__); - goto err_ion_handle; - } + rc = -EINVAL; + goto err_destroy_client; + } if (ionflag != NULL) { rc = ion_handle_get_flags(*client, *handle, ionflag); @@ -154,6 +166,7 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, *vaddr = ion_map_kernel(*client, *handle); if (IS_ERR_OR_NULL((void *)*vaddr)) { pr_err("%s: ION memory mapping for AUDIO failed\n", __func__); + rc = -ENOMEM; goto err_ion_handle; } pr_debug("%s: mapped address = %p, size=%d\n", __func__, *vaddr, bufsz); @@ -162,13 +175,20 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, err_ion_handle: ion_free(*client, *handle); +err_destroy_client: msm_audio_ion_client_destroy(*client); + *client = NULL; + *handle = NULL; err: - return -EINVAL; + return rc; } int msm_audio_ion_free(struct ion_client *client, struct ion_handle *handle) { + if (!client || !handle) { + pr_err("%s Invalid params\n", __func__); + return -EINVAL; + } if (msm_audio_ion_data.smmu_enabled) { /* Need to populate book kept infomation */ pr_debug("client=%p, domain=%p, domain_id=%d, group=%p", -- cgit v1.1