From 4989bafb07e4b2e94cd255581f965e00bb1940d2 Mon Sep 17 00:00:00 2001 From: Houston Hoffman Date: Thu, 25 Aug 2016 19:44:20 -0700 Subject: [PATCH] qcacmn: Check nbytes before posting in SLUB Check for valid nbytes values before posting descriptors to copy engines when sending messages to FW in slub builds. Change-Id: I6996aa5dc607be60c2434f04cd6b3249bc7df415 CRs-Fixed: 1060096 --- hif/src/ce/ce_service.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/hif/src/ce/ce_service.c b/hif/src/ce/ce_service.c index c7fe8d55e408..b6927c74a543 100644 --- a/hif/src/ce/ce_service.c +++ b/hif/src/ce/ce_service.c @@ -294,6 +294,27 @@ void war_ce_src_ring_write_idx_set(struct hif_softc *scn, } } +#ifdef CONFIG_SLUB_DEBUG_ON +/** + * ce_validate_nbytes() - validate nbytes for slub builds on tx descriptors + * @nbytes: nbytes value being written into a send descriptor + * @ce_state: context of the copy engine + + * nbytes should be non-zero and less than max configured for the copy engine + * + * Return: none + */ +static void ce_validate_nbytes(uint32_t nbytes, struct CE_state *ce_state) +{ + if (nbytes <= 0 || nbytes > ce_state->src_sz_max) + QDF_BUG(0); +} +#else +static void ce_validate_nbytes(uint32_t nbytes, struct CE_state *ce_state) +{ +} +#endif + int ce_send_nolock(struct CE_handle *copyeng, void *per_transfer_context, @@ -358,6 +379,7 @@ ce_send_nolock(struct CE_handle *copyeng, != 0) & ((flags & CE_SEND_FLAG_SWAP_DISABLE) == 0)); shadow_src_desc->gather = ((flags & CE_SEND_FLAG_GATHER) != 0); shadow_src_desc->nbytes = nbytes; + ce_validate_nbytes(nbytes, CE_state); *src_desc = *shadow_src_desc; @@ -614,6 +636,7 @@ int ce_send_fast(struct CE_handle *copyeng, qdf_nbuf_t msdu, ce_buffer_addr_hi_set(shadow_src_desc, dma_addr, user_flags); shadow_src_desc->meta_data = transfer_id; shadow_src_desc->nbytes = qdf_nbuf_get_frag_len(msdu, 0); + ce_validate_nbytes(shadow_src_desc->nbytes, ce_state); download_len -= shadow_src_desc->nbytes; /* * HTC HTT header is a word stream, so byte swap if CE byte @@ -652,6 +675,7 @@ int ce_send_fast(struct CE_handle *copyeng, qdf_nbuf_t msdu, /* download remaining bytes of payload */ shadow_src_desc->nbytes = download_len; + ce_validate_nbytes(shadow_src_desc->nbytes, ce_state); if (shadow_src_desc->nbytes > frag_len) shadow_src_desc->nbytes = frag_len;