Merge branch 'p-ti-lsk-linux-4.4.y-next' of git://git.omapzoom.org/kernel/omap into p-ti-android-linux-4.4.y

Auto Merge of:

TI-Feature: linux-4.4.y-next_android-4.4.y
TI-Tree: git://git.omapzoom.org/kernel/omap.git
TI-Branch: p-ti-lsk-linux-4.4.y-next

* 'p-ti-lsk-linux-4.4.y-next' of git://git.omapzoom.org/kernel/omap:
  net/rpmsg: fix a potential NULL pointer dereference in bind()
  net/rpmsg: fix possible kernel crash in callback for deleted sockets
  net/rpmsg: fix error status marking of new Rx sockets during recovery
  net/rpmsg: skip announcement of rpmsg devices created in bind()
  rpmsg: rpc: fix suspicious rcu_dereference_check() usage
  rpmsg: check for invalid parameters in couple of public API
  rpmsg: add input argument sanity checks to rpmsg_send functions

Signed-off-by: David Huang <d-huang@ti.com>

4 files changed, 50 insertions, 15 deletions

diff --git a/drivers/rpmsg/rpmsg_rpc.c b/drivers/rpmsg/rpmsg_rpc.c
index 009416f2cf6b..a335fe0cb1c8 100644
--- a/drivers/rpmsg/rpmsg_rpc.c
+++ b/drivers/rpmsg/rpmsg_rpc.c
@@ -441,10 +441,13 @@ static int rppc_register_buffers(struct rppc_instance *rpc,
         }
 
         for (i = 0; i < data.num; i++) {
+                rcu_read_lock();
                 if (!fcheck(fds[i])) {
+                        rcu_read_unlock();
                         ret = -EBADF;
                         goto free_fds;
                 }
+                rcu_read_unlock();
 
                 tmp = rppc_find_dmabuf(rpc, fds[i]);
                 if (!IS_ERR_OR_NULL(tmp)) {
@@ -511,10 +514,13 @@ static int rppc_unregister_buffers(struct rppc_instance *rpc,
         }
 
         for (i = 0; i < data.num; i++) {
+                rcu_read_lock();
                 if (!fcheck(fds[i])) {
+                        rcu_read_unlock();
                         ret = -EBADF;
                         goto free_bufs;
                 }
+                rcu_read_unlock();
 
                 bufs[i] = rppc_find_dmabuf(rpc, fds[i]);
                 if (IS_ERR_OR_NULL(bufs[i])) {
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index a9c8ffdb1407..d1735c83b1ae 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -323,6 +323,9 @@ free_ept:
 struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_channel *rpdev,
                                 rpmsg_rx_cb_t cb, void *priv, u32 addr)
 {
+        if (WARN_ON(!rpdev))
+                return NULL;
+
         return __rpmsg_create_ept(rpdev->vrp, rpdev, cb, priv, addr);
 }
 EXPORT_SYMBOL(rpmsg_create_ept);
@@ -358,11 +361,13 @@ __rpmsg_destroy_ept(struct virtproc_info *vrp, struct rpmsg_endpoint *ept)
  * @ept: endpoing to destroy
  *
  * Should be used by drivers to destroy an rpmsg endpoint previously
- * created with rpmsg_create_ept().
+ * created with rpmsg_create_ept(). As with other types of "free" NULL
+ * is a valid parameter.
  */
 void rpmsg_destroy_ept(struct rpmsg_endpoint *ept)
 {
-        __rpmsg_destroy_ept(ept->rpdev->vrp, ept);
+        if (ept)
+                __rpmsg_destroy_ept(ept->rpdev->vrp, ept);
 }
 EXPORT_SYMBOL(rpmsg_destroy_ept);
 
@@ -599,6 +604,9 @@ struct rpmsg_channel *rpmsg_create_channel(struct virtproc_info *vrp,
 {
         struct rpmsg_channel_info chinfo;
 
+        if (!vrp || !name || !desc)
+                return NULL;
+
         strncpy(chinfo.name, name, sizeof(chinfo.name));
         strncpy(chinfo.desc, desc, sizeof(chinfo.desc));
         chinfo.src = src;
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 1dcbca1232cc..1a163429d57e 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -227,9 +227,11 @@ int rpmsg_destroy_channel(struct rpmsg_channel *rpdev);
  */
 static inline int rpmsg_send(struct rpmsg_channel *rpdev, void *data, int len)
 {
-        u32 src = rpdev->src, dst = rpdev->dst;
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
 
-        return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, true);
+        return rpmsg_send_offchannel_raw(rpdev, rpdev->src, rpdev->dst, data,
+                                         len, true);
 }
 
 /**
@@ -253,9 +255,11 @@ static inline int rpmsg_send(struct rpmsg_channel *rpdev, void *data, int len)
 static inline
 int rpmsg_sendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst)
 {
-        u32 src = rpdev->src;
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
 
-        return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, true);
+        return rpmsg_send_offchannel_raw(rpdev, rpdev->src, dst, data,
+                                         len, true);
 }
 
 /**
@@ -282,6 +286,9 @@ static inline
 int rpmsg_send_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
                                                         void *data, int len)
 {
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
+
         return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, true);
 }
 
@@ -304,9 +311,11 @@ int rpmsg_send_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
 static inline
 int rpmsg_trysend(struct rpmsg_channel *rpdev, void *data, int len)
 {
-        u32 src = rpdev->src, dst = rpdev->dst;
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
 
-        return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, false);
+        return rpmsg_send_offchannel_raw(rpdev, rpdev->src, rpdev->dst, data,
+                                         len, false);
 }
 
 /**
@@ -329,9 +338,11 @@ int rpmsg_trysend(struct rpmsg_channel *rpdev, void *data, int len)
 static inline
 int rpmsg_trysendto(struct rpmsg_channel *rpdev, void *data, int len, u32 dst)
 {
-        u32 src = rpdev->src;
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
 
-        return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, false);
+        return rpmsg_send_offchannel_raw(rpdev, rpdev->src, dst, data,
+                                         len, false);
 }
 
 /**
@@ -357,6 +368,9 @@ static inline
 int rpmsg_trysend_offchannel(struct rpmsg_channel *rpdev, u32 src, u32 dst,
                                                         void *data, int len)
 {
+        if (WARN_ON(!rpdev))
+                return -EINVAL;
+
         return rpmsg_send_offchannel_raw(rpdev, src, dst, data, len, false);
 }
 
diff --git a/net/rpmsg/rpmsg_proto.c b/net/rpmsg/rpmsg_proto.c
index 010a9aed6dbf..60032195f2e4 100644
--- a/net/rpmsg/rpmsg_proto.c
+++ b/net/rpmsg/rpmsg_proto.c
@@ -440,6 +440,10 @@ rpmsg_sock_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (sa->family != AF_RPMSG)
                 return -EINVAL;
 
+        /* do not allow fixed addresses above the dynamically allocated range */
+        if (sa->addr >= RPMSG_RESERVED_ADDRESSES)
+                return -EINVAL;
+
         if (rpsk->rpdev)
                 return -EBUSY;
 
@@ -455,6 +459,11 @@ rpmsg_sock_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (!rpdev)
                 return -EINVAL;
 
+        if (!rpdev->ept) {
+                rpmsg_destroy_channel(rpdev);
+                return -EINVAL;
+        }
+
         rpsk->rpdev = rpdev;
         rpsk->unregister_rpdev = true;
         rpsk->rproc_id = sa->vproc_id;
@@ -544,7 +553,8 @@ static void __rpmsg_proto_cb(struct device *dev, int from_vproc_id, void *data,
 #endif
 
         if (!sk) {
-                dev_warn(dev, "callback for deleted socket (from %d)\n", src);
+                dev_warn(dev, "callback received for deleted socket (from %d)\n",
+                         src);
                 return;
         }
 
@@ -624,7 +634,7 @@ static int rpmsg_proto_probe(struct rpmsg_channel *rpdev)
                         id);
 
         if (dst == RPMSG_ADDR_ANY) {
-                /* Set announce to false and avoid extra delay when binding. */
+                /* do not announce bound sockets to remote processor */
                 rpdev->announce = false;
                 return 0;
         }
@@ -696,9 +706,6 @@ static void rpmsg_proto_remove(struct rpmsg_channel *rpdev)
         struct rpmsg_socket *rpsk, *tmp;
         struct sock *sk;
 
-        if (dst == RPMSG_ADDR_ANY)
-                return;
-
         id = rpmsg_sock_get_proc_id(rpdev);
 
         mutex_lock(&rpmsg_channels_lock);