DivestOS/Patches/Linux_CVEs-New/CVE-2014-9789/ANY/0.patch
2017-10-29 14:23:02 -04:00

106 lines
3.4 KiB
Diff

From 5720ed5c3a786e3ba0a2428ac45da5d7ec996b4e Mon Sep 17 00:00:00 2001
From: Gopikrishnaiah Anandan <agopik@codeaurora.org>
Date: Fri, 16 Aug 2013 17:34:21 -0400
Subject: Soc: msm: qdsp6v2: Fix invalid params handling
Alloc and free apis should sanity check all input params.
If allocation fails set client and ion handle to NULL.
Change-Id: Ide3bd782eb90ee8b033e39de232929a1ca7174b7
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
---
arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c b/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c
index 0c71659..f9e9d6d 100644
--- a/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c
+++ b/arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c
@@ -53,7 +53,11 @@ int msm_audio_ion_alloc(const char *name, struct ion_client **client,
pr_debug("%s:probe is not done, deferred\n", __func__);
return -EPROBE_DEFER;
}
-
+ if (!name || !client || !handle || !paddr || !vaddr
+ || !bufsz || !pa_len) {
+ pr_err("%s: Invalid params\n", __func__);
+ return -EINVAL;
+ }
*client = msm_audio_ion_client_create(UINT_MAX, name);
if (IS_ERR_OR_NULL((void *)(*client))) {
pr_err("%s: ION create client for AUDIO failed\n", __func__);
@@ -102,9 +106,9 @@ int msm_audio_ion_alloc(const char *name, struct ion_client **client,
err_ion_handle:
ion_free(*client, *handle);
- *handle = NULL;
err_ion_client:
msm_audio_ion_client_destroy(*client);
+ *handle = NULL;
*client = NULL;
err:
return -EINVAL;
@@ -116,10 +120,17 @@ int msm_audio_ion_import(const char *name, struct ion_client **client,
ion_phys_addr_t *paddr, size_t *pa_len, void **vaddr)
{
int rc = 0;
+ if (!name || !client || !handle || !ionflag || !paddr || !vaddr
+ || !bufsz || !pa_len) {
+ pr_err("%s: Invalid params\n", __func__);
+ rc = -EINVAL;
+ goto err;
+ }
*client = msm_audio_ion_client_create(UINT_MAX, name);
if (IS_ERR_OR_NULL((void *)(*client))) {
pr_err("%s: ION create client for AUDIO failed\n", __func__);
+ rc = -EINVAL;
goto err;
}
@@ -132,8 +143,9 @@ int msm_audio_ion_import(const char *name, struct ion_client **client,
if (IS_ERR_OR_NULL((void *) (*handle))) {
pr_err("%s: ion import dma buffer failed\n",
__func__);
- goto err_ion_handle;
- }
+ rc = -EINVAL;
+ goto err_destroy_client;
+ }
if (ionflag != NULL) {
rc = ion_handle_get_flags(*client, *handle, ionflag);
@@ -154,6 +166,7 @@ int msm_audio_ion_import(const char *name, struct ion_client **client,
*vaddr = ion_map_kernel(*client, *handle);
if (IS_ERR_OR_NULL((void *)*vaddr)) {
pr_err("%s: ION memory mapping for AUDIO failed\n", __func__);
+ rc = -ENOMEM;
goto err_ion_handle;
}
pr_debug("%s: mapped address = %p, size=%d\n", __func__, *vaddr, bufsz);
@@ -162,13 +175,20 @@ int msm_audio_ion_import(const char *name, struct ion_client **client,
err_ion_handle:
ion_free(*client, *handle);
+err_destroy_client:
msm_audio_ion_client_destroy(*client);
+ *client = NULL;
+ *handle = NULL;
err:
- return -EINVAL;
+ return rc;
}
int msm_audio_ion_free(struct ion_client *client, struct ion_handle *handle)
{
+ if (!client || !handle) {
+ pr_err("%s Invalid params\n", __func__);
+ return -EINVAL;
+ }
if (msm_audio_ion_data.smmu_enabled) {
/* Need to populate book kept infomation */
pr_debug("client=%p, domain=%p, domain_id=%d, group=%p",
--
cgit v1.1