A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Check nbytes before posting in SLUB

Browse source 
Check for valid nbytes values before posting descriptors
to copy engines when sending messages to FW in slub builds.

Change-Id: I6996aa5dc607be60c2434f04cd6b3249bc7df415
CRs-Fixed: 1060096
This commit is contained in:
Houston Hoffman 2016-08-25 19:44:20 -07:00 • committed by Vishwajith Upendra
commit 4989bafb07
1 changed files with 24 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

24
hif/src/ce/ce_service.c
View file

@ -294,6 +294,27 @@ void war_ce_src_ring_write_idx_set(struct hif_softc *scn,
}
}
#ifdef CONFIG_SLUB_DEBUG_ON
/**
* ce_validate_nbytes() - validate nbytes for slub builds on tx descriptors
* @nbytes: nbytes value being written into a send descriptor
* @ce_state: context of the copy engine
* nbytes should be non-zero and less than max configured for the copy engine
*
* Return: none
*/
static void ce_validate_nbytes(uint32_t nbytes, struct CE_state *ce_state)
{
if (nbytes <= 0 || nbytes > ce_state->src_sz_max)
QDF_BUG(0);
}
#else
static void ce_validate_nbytes(uint32_t nbytes, struct CE_state *ce_state)
{
}
#endif
int
ce_send_nolock(struct CE_handle *copyeng,
void *per_transfer_context,
@ -358,6 +379,7 @@ ce_send_nolock(struct CE_handle *copyeng,
!= 0) & ((flags & CE_SEND_FLAG_SWAP_DISABLE) == 0));
shadow_src_desc->gather = ((flags & CE_SEND_FLAG_GATHER) != 0);
shadow_src_desc->nbytes = nbytes;
ce_validate_nbytes(nbytes, CE_state);
*src_desc = *shadow_src_desc;
@ -614,6 +636,7 @@ int ce_send_fast(struct CE_handle *copyeng, qdf_nbuf_t msdu,
ce_buffer_addr_hi_set(shadow_src_desc, dma_addr, user_flags);
shadow_src_desc->meta_data = transfer_id;
shadow_src_desc->nbytes = qdf_nbuf_get_frag_len(msdu, 0);
ce_validate_nbytes(shadow_src_desc->nbytes, ce_state);
download_len -= shadow_src_desc->nbytes;
/*
* HTC HTT header is a word stream, so byte swap if CE byte
@ -652,6 +675,7 @@ int ce_send_fast(struct CE_handle *copyeng, qdf_nbuf_t msdu,
/* download remaining bytes of payload */
shadow_src_desc->nbytes = download_len;
ce_validate_nbytes(shadow_src_desc->nbytes, ce_state);
if (shadow_src_desc->nbytes > frag_len)
shadow_src_desc->nbytes = frag_len;