qbman: Corrections based on static analysis

ioctl_dma_map. String length check

Added check to ensure the string copied from user space is within
the length allowed for by the buffer and is null terminated.

qm_shutdown_fq. Remove deadcode

Removed the case statement label for QM_MCR_NP_STATE_OOS since
that condition is checked for earlier in the code and in that
case the function exits immediately.

ioctl_dma_lock. Remove NULL dereference

A pointer is made null and then there is an attempt to dereference one
of the members of the struct that it points to. This condition is never
reached normally, but in error conditions this path of execution may be
possible.

Added return -EFAULT to exit function safely and unlocked locked resources

usdpaa_get_unmapped_area. Arithmetic overflow protection

Added a check to ensure that memory length passed in does not result in
an invalid size to be passed because of a possible arithmetic overflow
that can occur in the subtraction in the macro USDPAA_MEM_ROUNDUP.

qman_ceetm_ccg_claim. If condition fix

Removed a check against an unsigned int value that checks if it is
below zero (negative). The unsigned value cannot be negative and the
compare will always fail in reality.

qman_create_portal. Add comment to clarify flow

Clarified why no check is made to ensure that qm_mr_current()
returned successfully. The addition of a redundant check was rejected
because it impairs the reader's understanding of the flow
by implying the possibility of a physically impossible path.

dpa_alloc_new. Fix memory leak in error conditions

Previously allocated memory which is passed by reference in
success (list_add_tail) is not freed in error conditions
that occur in other parts of the function. Added code to free
allocated memory in error cases.

qman_create_portal. Fix memory leak in error path

Added cleanup code that deletes malloced memory in case
of function failure after memory is allocated.

ioctl_dma_map. Input bound checks on values from USDPAA

Check the struct usdpaa_ioctl_dma_map, input, to ensure that values
copied from user space are valid input.

qman_init. Check init_pcfg return

Previously unused assignment is now being used. The return of
init_pcfg() was not checked for success. Now we check for success
and print an error message in case of failure.
There is a similar issue in bman_driver.

bman_init. Check init_pcfg return

Added check to ensure init_pcfg() is returning successfully.
Print an error message and return if in error case.
There is a similar issue in qman_driver.

Signed-off-by: Ahmed Mansour <Ahmed.Mansour@freescale.com>
Change-Id: I230678948c3e8e43aa5738045244c5dac0b5f5f5
Reviewed-on: http://git.am.freescale.net:8181/21381
Tested-by: Review Code-CDREVIEW <CDREVIEW@freescale.com>
Reviewed-by: Jeffrey Ladouceur <Jeffrey.Ladouceur@freescale.com>
Reviewed-by: Matthew Weigel <Matthew.Weigel@freescale.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/staging/fsl_qbman/bman_driver.c b/drivers/staging/fsl_qbman/bman_driver.c
index 7ef20e3..2eb590f 100644
--- a/drivers/staging/fsl_qbman/bman_driver.c
+++ b/drivers/staging/fsl_qbman/bman_driver.c
@@ -468,6 +468,10 @@ __init int bman_init(void)
 	list_for_each_entry(pcfg, &unshared_pcfgs, list) {
 		pcfg->public_cfg.is_shared = 0;
 		p = init_pcfg(pcfg);
+		if (!p) {
+			pr_crit("Unable to initialize bman portal\n");
+			return 0;
+		}
 	}
 	/* Step 5. */
 	list_for_each_entry(pcfg, &shared_pcfgs, list) {