diff options
author | Ahmed Mansour <Ahmed.Mansour@freescale.com> | 2014-11-05 20:28:53 (GMT) |
---|---|---|
committer | Matthew Weigel <Matthew.Weigel@freescale.com> | 2014-12-11 18:40:52 (GMT) |
commit | a4c8969e7491609f598d741d8f1a489cfa695670 (patch) | |
tree | 82c42b1e30eaded78c42b3adb5aa45b280b6f8d9 /drivers/accessibility | |
parent | 7dead8c7e1e624e1c1d4f7152f77821a22d3c697 (diff) | |
download | linux-fsl-qoriq-a4c8969e7491609f598d741d8f1a489cfa695670.tar.xz |
qbman: Corrections based on static analysis
ioctl_dma_map. String length check
Added check to ensure the string copied from user space is within
the length allowed for by the buffer and is null terminated.
qm_shutdown_fq. Remove deadcode
Removed the case statement label for QM_MCR_NP_STATE_OOS since
that condition is checked for earlier in the code and in that
case the function exits immediately.
ioctl_dma_lock. Remove NULL dereference
A pointer is made null and then there is an attempt to dereference one
of the members of the struct that it points to. This condition is never
reached normally, but in error conditions this path of execution may be
possible.
Added return -EFAULT to exit function safely and unlocked locked resources
usdpaa_get_unmapped_area. Arithmetic overflow protection
Added a check to ensure that memory length passed in does not result in
an invalid size to be passed because of a possible arithmetic overflow
that can occur in the subtraction in the macro USDPAA_MEM_ROUNDUP.
qman_ceetm_ccg_claim. If condition fix
Removed a check against an unsigned int value that checks if it is
below zero (negative). The unsigned value cannot be negative and the
compare will always fail in reality.
qman_create_portal. Add comment to clarify flow
Clarified why no check is made to ensure that qm_mr_current()
returned successfully. The addition of a redundant check was rejected
because it impairs the reader's understanding of the flow
by implying the possibility of a physically impossible path.
dpa_alloc_new. Fix memory leak in error conditions
Previously allocated memory which is passed by reference in
success (list_add_tail) is not freed in error conditions
that occur in other parts of the function. Added code to free
allocated memory in error cases.
qman_create_portal. Fix memory leak in error path
Added cleanup code that deletes malloced memory in case
of function failure after memory is allocated.
ioctl_dma_map. Input bound checks on values from USDPAA
Check the struct usdpaa_ioctl_dma_map, input, to ensure that values
copied from user space are valid input.
qman_init. Check init_pcfg return
Previously unused assignment is now being used. The return of
init_pcfg() was not checked for success. Now we check for success
and print an error message in case of failure.
There is a similar issue in bman_driver.
bman_init. Check init_pcfg return
Added check to ensure init_pcfg() is returning successfully.
Print an error message and return if in error case.
There is a similar issue in qman_driver.
Signed-off-by: Ahmed Mansour <Ahmed.Mansour@freescale.com>
Change-Id: I230678948c3e8e43aa5738045244c5dac0b5f5f5
Reviewed-on: http://git.am.freescale.net:8181/21381
Tested-by: Review Code-CDREVIEW <CDREVIEW@freescale.com>
Reviewed-by: Jeffrey Ladouceur <Jeffrey.Ladouceur@freescale.com>
Reviewed-by: Matthew Weigel <Matthew.Weigel@freescale.com>
Diffstat (limited to 'drivers/accessibility')
0 files changed, 0 insertions, 0 deletions