gpu: ion: omap: add checks for carveout addresses and sizes

This patch adds sanity checks on the carveout and size parameters
read from the device tree file and returns error. It also checks
if the device tree is populated and returns error accordingly.

Change-Id: Ic1f4e9d7c5f7e9361d9fe922544f9dbc105d99c3
Signed-off-by: Sundar Raman <a0393242@ti.com>

1 files changed, 36 insertions, 6 deletions

diff --git a/drivers/gpu/ion/omap/omap_ion.c b/drivers/gpu/ion/omap/omap_ion.c
index f3db9d7ca95..886dd6f8133 100755
--- a/drivers/gpu/ion/omap/omap_ion.c
+++ b/drivers/gpu/ion/omap/omap_ion.c
@@ -124,12 +124,6 @@ static int omap_ion_probe(struct platform_device *pdev)
         uint omap_ion_heap_tiler_size = 0;
         uint omap_ion_heap_nonsecure_tiler_size = 0;
         
-        omap_ion_device = ion_device_create(omap_ion_ioctl);
-        if (IS_ERR_OR_NULL(omap_ion_device)) {
-                kfree(heaps);
-                return PTR_ERR(omap_ion_device);
-        }
-
         if (node) {
                 of_property_read_u32(node, "ti,omap_ion_heap_secure_input_base",
                                      &omap_ion_heap_secure_input_base);
@@ -137,6 +131,19 @@ static int omap_ion_probe(struct platform_device *pdev)
                                      &omap_ion_heap_tiler_base);
                 of_property_read_u32(node, "ti,omap_ion_heap_nonsecure_tiler_base",
                                      &omap_ion_heap_nonsecure_tiler_base);
+                if (omap_ion_heap_secure_input_base == 0
+                        || omap_ion_heap_tiler_base == 0
+                        || omap_ion_heap_nonsecure_tiler_base == 0) {
+                        pr_err("%s: carveout memory address is null. please check dts file\n"
+                                "omap_ion_heap_secure_input_base = 0x%x\n"
+                                "omap_ion_heap_tiler_base = 0x%x\n"
+                                "omap_ion_heap_nonsecure_tiler_base = 0x%x\n"
+                                , __func__
+                                , omap_ion_heap_secure_input_base
+                                , omap_ion_heap_tiler_base
+                                , omap_ion_heap_tiler_base);
+                        return -EFAULT;
+                }
 
                 of_property_read_u32(node, "ti,omap_ion_heap_secure_input_size",
                                      &omap_ion_heap_secure_input_size);
@@ -144,8 +151,30 @@ static int omap_ion_probe(struct platform_device *pdev)
                                      &omap_ion_heap_tiler_size);
                 of_property_read_u32(node, "ti,omap_ion_heap_nonsecure_tiler_size",
                                      &omap_ion_heap_nonsecure_tiler_size);
+                if (omap_ion_heap_secure_input_size == 0
+                        || omap_ion_heap_tiler_size == 0
+                        || omap_ion_heap_nonsecure_tiler_size == 0) {
+                        pr_err("%s: carveout memory address is null. please check dts file\n"
+                                "omap_ion_heap_secure_input_size = 0x%x\n"
+                                "omap_ion_heap_tiler_size = 0x%x\n"
+                                "omap_ion_heap_nonsecure_tiler_size = 0x%x\n"
+                                , __func__
+                                , omap_ion_heap_secure_input_size
+                                , omap_ion_heap_tiler_size
+                                , omap_ion_heap_nonsecure_tiler_size);
+                        return -EINVAL;
+                }
+
+        } else {
+                pr_err("%s: no matching device tree node\n", __func__);
+                return -ENODEV;
         }
 
+        omap_ion_device = ion_device_create(omap_ion_ioctl);
+        if (IS_ERR_OR_NULL(omap_ion_device))
+                return PTR_ERR(omap_ion_device);
+
+
         num_heaps = omap_ion_data.nr;
 
         heaps = kzalloc(sizeof(struct ion_heap *)*num_heaps, GFP_KERNEL);
@@ -242,6 +271,7 @@ int omap_ion_share_fd_to_buffers(int fd, struct ion_buffer **buffers,
         struct ion_handle **handles;
         struct ion_client *client;
         int i = 0, ret = 0;
+        int share_fd;
 
         handles = kzalloc(*num_handles * sizeof(struct ion_handle *),
                           GFP_KERNEL);