diff options
| author |   Johan Hovold <johan@hovoldconsulting.com> | 2016-02-24 16:11:50 +0100 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@google.com> | 2016-02-24 17:26:05 -0800 |
| commit | cb7f00ba5f581ca2f0848dd2ed77f1b9d793c648 (patch) | |
| tree | b2b864e21bf442fe70b57a1c8f17d8092a168252 /drivers/staging/greybus/uart.c | |
| parent | greybus: uart: add max-payload sanity check (diff) | |
| download | linux-dev-cb7f00ba5f581ca2f0848dd2ed77f1b9d793c648.tar.xz linux-dev-cb7f00ba5f581ca2f0848dd2ed77f1b9d793c648.zip | |
greybus: uart: add missing serial-state sanity check
Add dedicated serial-state request handler and add the missing sanity
check on the incoming request.
Reviewed-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Diffstat (limited to 'drivers/staging/greybus/uart.c')
| -rw-r--r-- | drivers/staging/greybus/uart.c | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c index 60617cb69a5a..c09a76bee269 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -103,13 +103,32 @@ static int gb_uart_receive_data(struct gb_tty *gb_tty, return 0; } -static int gb_uart_request_recv(u8 type, struct gb_operation *op) +static int gb_uart_serial_state_handler(struct gb_operation *op) { struct gb_connection *connection = op->connection; struct gb_tty *gb_tty = connection->private; struct gb_message *request = op->request; struct gb_uart_serial_state_request *serial_state; - int ret = 0; + + if (request->payload_size < sizeof(*serial_state)) { + dev_err(&connection->bundle->dev, + "short serial-state event received (%zu < %zu)\n", + request->payload_size, sizeof(*serial_state)); + return -EINVAL; + } + + serial_state = request->payload; + gb_tty->ctrlin = serial_state->control; + + return 0; +} + +static int gb_uart_request_recv(u8 type, struct gb_operation *op) +{ + struct gb_connection *connection = op->connection; + struct gb_tty *gb_tty = connection->private; + struct gb_message *request = op->request; + int ret; switch (type) { case GB_UART_TYPE_RECEIVE_DATA: @@ -117,8 +136,7 @@ static int gb_uart_request_recv(u8 type, struct gb_operation *op) request->payload); break; case GB_UART_TYPE_SERIAL_STATE: - serial_state = request->payload; - gb_tty->ctrlin = serial_state->control; + ret = gb_uart_serial_state_handler(op); break; default: dev_err(&connection->bundle->dev, |