From patchwork Thu Jul 2 14:21:07 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ameya Palande X-Patchwork-Id: 33683 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n62EM9P4003708 for ; Thu, 2 Jul 2009 14:22:10 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754180AbZGBOV7 (ORCPT ); Thu, 2 Jul 2009 10:21:59 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753944AbZGBOV7 (ORCPT ); Thu, 2 Jul 2009 10:21:59 -0400 Received: from smtp.nokia.com ([192.100.122.230]:42697 "EHLO mgw-mx03.nokia.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754180AbZGBOV5 (ORCPT ); Thu, 2 Jul 2009 10:21:57 -0400 Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx03.nokia.com (Switch-3.3.3/Switch-3.3.3) with ESMTP id n62ELii7030536; Thu, 2 Jul 2009 17:21:51 +0300 Received: from vaebh104.NOE.Nokia.com ([10.160.244.30]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 2 Jul 2009 17:21:16 +0300 Received: from mgw-da02.ext.nokia.com ([147.243.128.26]) by vaebh104.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 2 Jul 2009 17:21:15 +0300 Received: from localhost.localdomain (esdhcp041160.research.nokia.com [172.21.41.160]) by mgw-da02.ext.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id n62EL584006485; Thu, 2 Jul 2009 17:21:09 +0300 From: Ameya Palande To: linux-omap@vger.kernel.org Cc: x0095840@ti.com, h-kanigeri2@ti.com, ext-phil.2.carmody@nokia.com Subject: [PATCH 3/4] DSPBRIDGE: PROCWRAP_Load function cleanup in a complete mess Date: Thu, 2 Jul 2009 17:21:07 +0300 Message-Id: <1246544468-14546-3-git-send-email-ameya.palande@nokia.com> X-Mailer: git-send-email 1.6.2.4 In-Reply-To: <1246544468-14546-2-git-send-email-ameya.palande@nokia.com> References: <1246544468-14546-1-git-send-email-ameya.palande@nokia.com> <1246544468-14546-2-git-send-email-ameya.palande@nokia.com> X-OriginalArrivalTime: 02 Jul 2009 14:21:16.0153 (UTC) FILETIME=[5C38EE90:01C9FB20] X-Nokia-AV: Clean Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org From: Phil Carmody If you followed some failure paths, it was entirely possible that you'd attempt to MEM_Free a user-space pointer, because it wouldn't have been replaced with a kernel-space copy yet. Now replace all untouched pointers with NULL, so the cleanup does nothing for those ones. Signed-off-by: Phil Carmody Signed-off-by: Ameya Palande --- drivers/dsp/bridge/pmgr/wcd.c | 95 +++++++++++++++++++++++----------------- 1 files changed, 55 insertions(+), 40 deletions(-) diff --git a/drivers/dsp/bridge/pmgr/wcd.c b/drivers/dsp/bridge/pmgr/wcd.c index 00b2770..2fd9f8c 100644 --- a/drivers/dsp/bridge/pmgr/wcd.c +++ b/drivers/dsp/bridge/pmgr/wcd.c @@ -880,83 +880,99 @@ u32 PROCWRAP_Load(union Trapped_Args *args) { s32 i, len; DSP_STATUS status = DSP_SOK; - char *temp; - s32 argc = args->ARGS_PROC_LOAD.iArgc; + char *temp; + s32 count = args->ARGS_PROC_LOAD.iArgc; u8 **argv, **envp = NULL; + DBC_Require(count > 0); + DBC_Require(count <= MAX_LOADARGS); - DBC_Require(argc > 0); - DBC_Require(argc <= MAX_LOADARGS); - - argv = MEM_Alloc(argc * sizeof(u8 *), MEM_NONPAGED); - if (argv == NULL) + argv = MEM_Alloc(count * sizeof(u8 *), MEM_NONPAGED); + if (!argv) { status = DSP_EMEMORY; + goto func_cont; + } - cp_fm_usr(argv, args->ARGS_PROC_LOAD.aArgv, status, argc); - if (DSP_FAILED(status)) + cp_fm_usr(argv, args->ARGS_PROC_LOAD.aArgv, status, count); + if (DSP_FAILED(status)) { + MEM_Free(argv); + argv = NULL; goto func_cont; + } - for (i = 0; DSP_SUCCEEDED(status) && (i < argc); i++) { + for (i = 0; DSP_SUCCEEDED(status) && (i < count); i++) { if (argv[i] != NULL) { /* User space pointer to argument */ - temp = (char *) argv[i]; - len = strlen_user((char *)temp); + temp = (char *) argv[i]; + len = strlen_user((char *)temp); /* Kernel space pointer to argument */ argv[i] = MEM_Alloc(len + 1, MEM_NONPAGED); - if (argv[i] == NULL) { + if (argv[i] != NULL) { + cp_fm_usr(argv[i], temp, status, len); + } else { status = DSP_EMEMORY; - break; } - cp_fm_usr(argv[i], temp, status, len); - if (DSP_FAILED(status)) + + if (DSP_FAILED(status)) { + while (i < count) + argv[i++] = NULL; goto func_cont; + } argv[i][len] = '\0'; } } /* TODO: validate this */ if (args->ARGS_PROC_LOAD.aEnvp != NULL) { /* number of elements in the envp array including NULL */ - len = 0; + count = 0; do { - len++; - get_user(temp, args->ARGS_PROC_LOAD.aEnvp); - } while (temp); - envp = MEM_Alloc(len * sizeof(u8 *), MEM_NONPAGED); + count++; + get_user(temp, args->ARGS_PROC_LOAD.aEnvp); + } while (temp); + envp = MEM_Alloc(count * sizeof(u8 *), MEM_NONPAGED); if (envp == NULL) { status = DSP_EMEMORY; goto func_cont; } - cp_fm_usr(envp, args->ARGS_PROC_LOAD.aEnvp, status, len); - if (DSP_FAILED(status)) + cp_fm_usr(envp, args->ARGS_PROC_LOAD.aEnvp, status, count); + if (DSP_FAILED(status)) { + MEM_Free(envp); + envp = NULL; goto func_cont; + } for (i = 0; DSP_SUCCEEDED(status) && (envp[i] != NULL); i++) { /* User space pointer to argument */ - temp = (char *)envp[i]; - len = strlen_user((char *)temp); + temp = (char *)envp[i]; + len = strlen_user((char *)temp); /* Kernel space pointer to argument */ envp[i] = MEM_Alloc(len + 1, MEM_NONPAGED); - if (envp[i] == NULL) { + if (envp[i] != NULL) { + cp_fm_usr(envp[i], temp, status, len); + } else { status = DSP_EMEMORY; - break; } - cp_fm_usr(envp[i], temp, status, len); - if (DSP_FAILED(status)) + + if (DSP_FAILED(status)) { + while (i < count) + envp[i++] = NULL; goto func_cont; + } envp[i][len] = '\0'; } } GT_5trace(WCD_debugMask, GT_ENTER, - "PROCWRAP_Load, hProcessor: 0x%x\n\tiArgc:" - "0x%x\n\taArgv: 0x%x\n\taArgv[0]: %s\n\taEnvp: 0x%0x\n", - args->ARGS_PROC_LOAD.hProcessor, - args->ARGS_PROC_LOAD.iArgc, args->ARGS_PROC_LOAD.aArgv, - argv[0], args->ARGS_PROC_LOAD.aEnvp); + "PROCWRAP_Load, hProcessor: 0x%x\n\tiArgc:" + "0x%x\n\taArgv: 0x%x\n\taArgv[0]: %s\n\taEnvp: 0x%0x\n", + args->ARGS_PROC_LOAD.hProcessor, + args->ARGS_PROC_LOAD.iArgc, args->ARGS_PROC_LOAD.aArgv, + argv[0], args->ARGS_PROC_LOAD.aEnvp); if (DSP_SUCCEEDED(status)) { status = PROC_Load(args->ARGS_PROC_LOAD.hProcessor, - args->ARGS_PROC_LOAD.iArgc, - (CONST char **)argv, (CONST char **)envp); + args->ARGS_PROC_LOAD.iArgc, + (CONST char **)argv, (CONST char **)envp); } + func_cont: if (envp != NULL) { i = 0; @@ -966,11 +982,10 @@ func_cont: MEM_Free(envp); } if (argv != NULL) { - for (i = 0; i < argc; i++) { - if (argv[i] != NULL) - MEM_Free(argv[i]); + count = args->ARGS_PROC_LOAD.iArgc; + for (i = 0; (i < count) && argv[i]; i++) + MEM_Free(argv[i++]); - } MEM_Free(argv); } return status;