From 75f8537e1c8c8a0dc5e694d6baf1a09ecdd15ffe Mon Sep 17 00:00:00 2001
From: Andy Carman <acarman@nvidia.com>
Date: Sat, 2 Oct 2010 13:02:23 -0700
Subject: [tegra video]  add param checking to mem functions

(cherry picked from commit 9dc305371bfe820db10e554e0bd8e60b16f94ab8)

Change-Id: Ie857ffa2ebdb2eec5b75bf93ae954798e74dad3f
Reviewed-on: http://git-master/r/9847
Reviewed-by: Varun Colbert <vcolbert@nvidia.com>
Tested-by: Varun Colbert <vcolbert@nvidia.com>
---
 drivers/video/tegra/nvmap.c | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/drivers/video/tegra/nvmap.c b/drivers/video/tegra/nvmap.c
index f260e1cb9573..ffa1142b6aef 100644
--- a/drivers/video/tegra/nvmap.c
+++ b/drivers/video/tegra/nvmap.c
@@ -1613,6 +1613,12 @@ static int _nvmap_handle_unpin(struct nvmap_handle *h)
 {
 	int ret = 0;
 
+	if(!h || !h->alloc ) {
+		WARN_ON(1);
+		pr_err("%s invalid handle, returning -EINVAL\n",__func__);
+		return -EINVAL;
+	}
+
 	if (atomic_add_return(0, &h->pin)==0) {
 		pr_err("%s: %s attempting to unpin an unpinned handle\n",
 			__func__, current->comm);
@@ -1660,6 +1666,11 @@ static int _nvmap_handle_pin_fast(unsigned int nr, struct nvmap_handle **h)
 	unsigned int i;
 	int ret = 0;
 
+	if ( !(h && *h && ((*h)->alloc)) ) {
+		pr_err("%s invalid handle, returning -EINVAL\n",__func__);
+		return -EINVAL;
+	}
+
 	mutex_lock(&nvmap_pin_lock);
 	for (i=0; i<nr && !ret; i++) {
 		ret = wait_event_interruptible(nvmap_pin_wait,
@@ -1741,6 +1752,11 @@ static int _nvmap_do_pin(struct nvmap_file_priv *priv,
 	struct nvmap_handle **h = (struct nvmap_handle **)refs;
 	struct nvmap_handle_ref *r;
 
+	if ((*h==NULL) || ( !(*h)->alloc )) {
+		pr_err("%s invalid handle, returning -EINVAL\n",__func__);
+		return -EINVAL;
+	}
+
 	/* to optimize for the common case (client provided valid handle
 	 * references and the pin succeeds), increment the handle_ref pin
 	 * count during validation. in error cases, the tree will need to
@@ -2410,11 +2426,11 @@ static int _nvmap_do_alloc(struct nvmap_file_priv *priv,
 				NVMAP_TRACE(NVMAP_TRACE_LFB,
 					"nvmap: lfb after alloc %lu\n",
 					_nvmap_carveout_blockstat(
-						h->carveout.co_heap, 
+						h->carveout.co_heap,
 						CARVEOUT_STAT_LARGEST_FREE));
 
 				NVMAP_TRACE(NVMAP_TRACE_FREE_SIZE,
-					"nvmap: Free size after alloc %lu\n", 
+					"nvmap: Free size after alloc %lu\n",
 					_nvmap_carveout_blockstat(
 						h->carveout.co_heap,
 						CARVEOUT_STAT_FREE_SIZE));
@@ -2996,7 +3012,10 @@ static ssize_t _nvmap_do_rw_handle(struct nvmap_handle *h, int is_read,
 	void *addr = NULL;
 
 	h = _nvmap_handle_get(h);
-	if (!h) return -EINVAL;
+	if ((!h)  || ( !h->alloc )) {
+		pr_err("%s invalid handle, returning -EINVAL\n",__func__);
+		return -EINVAL;
+	}
 
 	if (elem_size == h_stride &&
 	    elem_size == sys_stride) {
@@ -3551,6 +3570,12 @@ void NvRmMemPinMult(NvRmMemHandle *hMems, NvU32 *addrs, NvU32 Count)
 	unsigned int i;
 	int ret;
 
+	if ( !(*h)->alloc ) {
+		pr_err("%s invalid handle\n",__func__);
+		*addrs=0;
+		return;
+	}
+
 	do {
 		ret = _nvmap_handle_pin_fast(Count, h);
 		if (ret && !try_to_freeze()) {
-- 
cgit v1.2.3