Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

Merge "msm: ipa: fix KW errors of access to invalid array element"

This commit is contained in:
Linux Build Service Account 2015-06-30 06:49:52 -07:00 committed by Gerrit - the friendly Code Review server
parent cd37eb066a 1481c6ad37
commit bafa8ed2c0
4 changed files with 64 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/platform/msm/ipa/ipa_dma.c
View File

@ -414,8 +414,19 @@ int ipa_dma_sync_memcpy(phys_addr_t dest, phys_addr_t src, int len)
}
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_MEMCPY_DMA_SYNC_CONS);
if (-1 == ep_idx) {
IPADMA_ERR("Client %u is not mapped\n",
IPA_CLIENT_MEMCPY_DMA_SYNC_CONS);
return -EFAULT;
}
cons_sys = ipa_ctx->ep[ep_idx].sys;
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_MEMCPY_DMA_SYNC_PROD);
if (-1 == ep_idx) {
IPADMA_ERR("Client %u is not mapped\n",
IPA_CLIENT_MEMCPY_DMA_SYNC_PROD);
return -EFAULT;
}
prod_sys = ipa_ctx->ep[ep_idx].sys;
xfer_descr = kmem_cache_zalloc(ipa_dma_ctx->ipa_dma_xfer_wrapper_cache,
@ -555,8 +566,19 @@ int ipa_dma_async_memcpy(phys_addr_t dest, phys_addr_t src, int len,
}
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS);
if (-1 == ep_idx) {
IPADMA_ERR("Client %u is not mapped\n",
IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS);
return -EFAULT;
}
cons_sys = ipa_ctx->ep[ep_idx].sys;
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD);
if (-1 == ep_idx) {
IPADMA_ERR("Client %u is not mapped\n",
IPA_CLIENT_MEMCPY_DMA_SYNC_PROD);
return -EFAULT;
}
prod_sys = ipa_ctx->ep[ep_idx].sys;
xfer_descr = kmem_cache_zalloc(ipa_dma_ctx->ipa_dma_xfer_wrapper_cache,

14
drivers/platform/msm/ipa/ipa_dp.c
View File

@ -577,6 +577,11 @@ int ipa_send_cmd(u16 num_desc, struct ipa_desc *descr)
IPADBG("sending command\n");
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_APPS_CMD_PROD);
if (-1 == ep_idx) {
IPAERR("Client %u is not mapped\n",
IPA_CLIENT_APPS_CMD_PROD);
return -EFAULT;
}
sys = ipa_ctx->ep[ep_idx].sys;
ipa_inc_client_enable_clks();
@ -1309,9 +1314,18 @@ int ipa_tx_dp(enum ipa_client_type dst, struct sk_buff *skb,
*/
if (IPA_CLIENT_IS_CONS(dst)) {
src_ep_idx = ipa_get_ep_mapping(IPA_CLIENT_APPS_LAN_WAN_PROD);
if (-1 == src_ep_idx) {
IPAERR("Client %u is not mapped\n",
IPA_CLIENT_APPS_LAN_WAN_PROD);
return -EFAULT;
}
dst_ep_idx = ipa_get_ep_mapping(dst);
} else {
src_ep_idx = ipa_get_ep_mapping(dst);
if (-1 == src_ep_idx) {
IPAERR("Client %u is not mapped\n", dst);
return -EFAULT;
}
if (meta && meta->pkt_init_dst_ep_valid)
dst_ep_idx = meta->pkt_init_dst_ep;
else

6
drivers/platform/msm/ipa/ipa_mhi.c
View File

@ -840,6 +840,12 @@ static int ipa_mhi_reset_ul_channel(struct ipa_mhi_channel_ctx *channel)
continue;
ep_idx = ipa_get_ep_mapping(
ipa_mhi_ctx->dl_channels[i].client);
if (-1 == ep_idx) {
IPA_MHI_ERR("Client %u is not mapped\n",
ipa_mhi_ctx->dl_channels[i].client);
BUG();
return -EFAULT;
}
memset(&ep_holb, 0, sizeof(ep_holb));
ep_holb.en = 1;
ep_holb.tmr_val = 0;

24
drivers/platform/msm/ipa/ipa_utils.c
View File

@ -121,6 +121,8 @@ static const int ep_mapping[3][IPA_CLIENT_MAX] = {
[IPA_2_0][IPA_CLIENT_MHI_PROD] = 18,
[IPA_2_0][IPA_CLIENT_Q6_LAN_PROD] = 6,
[IPA_2_0][IPA_CLIENT_Q6_CMD_PROD] = 7,
[IPA_2_0][IPA_CLIENT_Q6_DECOMP_PROD] = -1,
[IPA_2_0][IPA_CLIENT_Q6_DECOMP2_PROD] = -1,
[IPA_2_0][IPA_CLIENT_MEMCPY_DMA_SYNC_PROD]
= 12,
[IPA_2_0][IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD]
@ -157,6 +159,8 @@ static const int ep_mapping[3][IPA_CLIENT_MAX] = {
[IPA_2_0][IPA_CLIENT_Q6_LAN_CONS] = 8,
[IPA_2_0][IPA_CLIENT_Q6_WAN_CONS] = 9,
[IPA_2_0][IPA_CLIENT_Q6_DUN_CONS] = 10,
[IPA_2_0][IPA_CLIENT_Q6_DECOMP_CONS] = -1,
[IPA_2_0][IPA_CLIENT_Q6_DECOMP2_CONS] = -1,
[IPA_2_0][IPA_CLIENT_MEMCPY_DMA_SYNC_CONS]
= 13,
[IPA_2_0][IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS]
@ -185,10 +189,15 @@ static const int ep_mapping[3][IPA_CLIENT_MAX] = {
[IPA_2_6L][IPA_CLIENT_APPS_LAN_WAN_PROD] = 4,
[IPA_2_6L][IPA_CLIENT_APPS_CMD_PROD] = 3,
[IPA_2_6L][IPA_CLIENT_ODU_PROD] = -1,
[IPA_2_6L][IPA_CLIENT_MHI_PROD] = -1,
[IPA_2_6L][IPA_CLIENT_Q6_LAN_PROD] = 6,
[IPA_2_6L][IPA_CLIENT_Q6_CMD_PROD] = 7,
[IPA_2_6L][IPA_CLIENT_Q6_DECOMP_PROD] = 11,
[IPA_2_6L][IPA_CLIENT_Q6_DECOMP2_PROD] = 13,
[IPA_2_6L][IPA_CLIENT_MEMCPY_DMA_SYNC_PROD]
= -1,
[IPA_2_6L][IPA_CLIENT_MEMCPY_DMA_ASYNC_PROD]
= -1,
/* Only for test purpose */
[IPA_2_6L][IPA_CLIENT_TEST_PROD] = 11,
@ -218,12 +227,16 @@ static const int ep_mapping[3][IPA_CLIENT_MAX] = {
[IPA_2_6L][IPA_CLIENT_APPS_WAN_CONS] = 5,
[IPA_2_6L][IPA_CLIENT_ODU_EMB_CONS] = -1,
[IPA_2_6L][IPA_CLIENT_ODU_TETH_CONS] = -1,
[IPA_2_6L][IPA_CLIENT_MHI_CONS] = -1,
[IPA_2_6L][IPA_CLIENT_Q6_LAN_CONS] = 8,
[IPA_2_6L][IPA_CLIENT_Q6_WAN_CONS] = 9,
[IPA_2_6L][IPA_CLIENT_Q6_DUN_CONS] = -1,
[IPA_2_6L][IPA_CLIENT_Q6_DECOMP_CONS] = 12,
[IPA_2_6L][IPA_CLIENT_Q6_DECOMP2_CONS] = 14,
[IPA_2_6L][IPA_CLIENT_MEMCPY_DMA_SYNC_CONS]
= -1,
[IPA_2_6L][IPA_CLIENT_MEMCPY_DMA_ASYNC_CONS]
= -1,
/* Only for test purpose */
[IPA_2_6L][IPA_CLIENT_TEST_CONS] = 15,
[IPA_2_6L][IPA_CLIENT_TEST1_CONS] = 15,
@ -4390,6 +4403,7 @@ int ipa_tag_process(struct ipa_desc desc[],
struct sk_buff *dummy_skb;
int res;
struct ipa_tag_completion *comp;
int ep_idx;
/* Not enough room for the required descriptors for the tag process */
if (IPA_TAG_MAX_DESC - descs_num < REQUIRED_TAG_PROCESS_DESCRIPTORS) {
@ -4399,7 +4413,13 @@ int ipa_tag_process(struct ipa_desc desc[],
return -ENOMEM;
}
sys = ipa_ctx->ep[ipa_get_ep_mapping(IPA_CLIENT_APPS_CMD_PROD)].sys;
ep_idx = ipa_get_ep_mapping(IPA_CLIENT_APPS_CMD_PROD);
if (-1 == ep_idx) {
IPAERR("Client %u is not mapped\n",
IPA_CLIENT_APPS_CMD_PROD);
return -EFAULT;
}
sys = ipa_ctx->ep[ep_idx].sys;
tag_desc = kzalloc(sizeof(*tag_desc) * IPA_TAG_MAX_DESC, GFP_KERNEL);
if (!tag_desc) {