msm: ipa: Add parameters validation to handle static analysis issues

Check input parameter range before using it to access
array elements and check pointer value before
dereferencing it.

Change-Id: I702b4ff11582047b00e3f0d5433d29c84f34e913
CRs-Fixed: 1048706
Signed-off-by: Ghanim Fodi <gfodi@codeaurora.org>

diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
index 6c4d14b..bcd2cb3 100644 (file)
--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
@@ -535,6 +535,11 @@ static int ipahal_imm_cmd_init(enum ipa_hw_type ipa_hw_type)
 
        IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type);
 
+       if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) {
+               IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type);
+               return -EINVAL;
+       }
+
        memset(&zero_obj, 0, sizeof(zero_obj));
        for (i = IPA_HW_v3_0 ; i < ipa_hw_type ; i++) {
                for (j = 0; j < IPA_IMM_CMD_MAX ; j++) {
@@ -901,6 +906,11 @@ static int ipahal_pkt_status_init(enum ipa_hw_type ipa_hw_type)
 
        IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type);
 
+       if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) {
+               IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type);
+               return -EINVAL;
+       }
+
        /*
         * Since structure alignment is implementation dependent,
         * add test to avoid different and incompatible data layouts.
@@ -1269,6 +1279,12 @@ int ipahal_init(enum ipa_hw_type ipa_hw_type, void __iomem *base,
                goto bail_free_ctx;
        }
 
+       if (ipa_hw_type >= IPA_HW_MAX) {
+               IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type);
+               result = -EINVAL;
+               goto bail_free_ctx;
+       }
+
        if (!base) {
                IPAHAL_ERR("invalid memory io mapping addr\n");
                result = -EINVAL;

diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c
index c47d353..a3345d7 100644 (file)
--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal_reg.c
@@ -1066,6 +1066,11 @@ int ipahal_reg_init(enum ipa_hw_type ipa_hw_type)
 
        IPAHAL_DBG_LOW("Entry - HW_TYPE=%d\n", ipa_hw_type);
 
+       if ((ipa_hw_type < 0) || (ipa_hw_type >= IPA_HW_MAX)) {
+               IPAHAL_ERR("invalid IPA HW type (%d)\n", ipa_hw_type);
+               return -EINVAL;
+       }
+
        memset(&zero_obj, 0, sizeof(zero_obj));
        for (i = IPA_HW_v3_0 ; i < ipa_hw_type ; i++) {
                for (j = 0; j < IPA_REG_MAX ; j++) {