fix 21 bug-drivers_hdf

Madapter/khdf/linux/model/usb/host/src/usb_pnp_notify.c+31-11

	@@ -307,22 +307,23 @@ static int32_t UsbPnpNotifyGetDeviceInfo(
307	void eventData, union UsbPnpDeviceInfoData pnpInfoData, struct UsbPnpDeviceInfo **deviceInfo)	307	void eventData, union UsbPnpDeviceInfoData pnpInfoData, struct UsbPnpDeviceInfo **deviceInfo)
308	{	308	{
309	struct UsbInfoQueryPara infoQueryPara;	309	struct UsbInfoQueryPara infoQueryPara;
		310	+ int32_t cmdType = g_usbPnpNotifyCmdType;
310		311
311	- if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|	312	+ if ((cmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|
312	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {	313	+ (cmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {
313	pnpInfoData->infoData = (struct UsbPnpAddRemoveInfo *)eventData;	314	pnpInfoData->infoData = (struct UsbPnpAddRemoveInfo *)eventData;
314	} else {	315	} else {
315	pnpInfoData->usbDev = (struct usb_device *)eventData;	316	pnpInfoData->usbDev = (struct usb_device *)eventData;
316	}	317	}
317		318
318	- if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|	319	+ if ((cmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|
319	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {	320	+ (cmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {
320	infoQueryPara.type = USB_INFO_NORMAL_TYPE;	321	infoQueryPara.type = USB_INFO_NORMAL_TYPE;
321	infoQueryPara.devNum = pnpInfoData->infoData->devNum;	322	infoQueryPara.devNum = pnpInfoData->infoData->devNum;
322	infoQueryPara.busNum = pnpInfoData->infoData->busNum;	323	infoQueryPara.busNum = pnpInfoData->infoData->busNum;
323	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);	324	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);
324	- } else if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_DEVICE) \|\|	325	+ } else if ((cmdType == USB_PNP_NOTIFY_ADD_DEVICE) \|\|
325	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_DEVICE)) {	326	+ (cmdType == USB_PNP_NOTIFY_REMOVE_DEVICE)) {
326	infoQueryPara.type = USB_INFO_DEVICE_ADDRESS_TYPE;	327	infoQueryPara.type = USB_INFO_DEVICE_ADDRESS_TYPE;
327	infoQueryPara.usbDevAddr = (uint64_t)pnpInfoData->usbDev;	328	infoQueryPara.usbDevAddr = (uint64_t)pnpInfoData->usbDev;
328	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);	329	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);
	@@ -434,13 +435,28 @@ static void TestReadPnpInfo(struct HdfSBuf *data)
434	{	435	{
435	uint32_t infoSize;	436	uint32_t infoSize;
436	bool flag;	437	bool flag;
		438	+ const struct UsbPnpNotifyMatchInfoTable *tmpInfo = NULL;
437		439
438	- flag = HdfSbufReadBuffer(data, (const void **)(&g_testUsbPnpInfo), &infoSize);	440	+ flag = HdfSbufReadBuffer(data, (const void **)(&tmpInfo), &infoSize);
439	- if ((!flag) \|\| (g_testUsbPnpInfo == NULL)) {	441	+ if ((!flag) \|\| (tmpInfo == NULL) \|\| (infoSize < sizeof(struct UsbPnpNotifyMatchInfoTable))) {
440	HDF_LOGE("%s: fail to read g_testUsbPnpInfo, flag=%d", __func__, flag);	442	HDF_LOGE("%s: fail to read g_testUsbPnpInfo, flag=%d", __func__, flag);
441	return;	443	return;
442	}	444	}
443		445
		446	+ struct UsbPnpNotifyMatchInfoTable *newInfo =
		447	+ (struct UsbPnpNotifyMatchInfoTable *)OsalMemCalloc(sizeof(struct UsbPnpNotifyMatchInfoTable));
		448	+ if (newInfo == NULL) {
		449	+ HDF_LOGE("%s: alloc failed", __func__);
		450	+ return;
		451	+ }
		452	+ if (memcpy_s(newInfo, sizeof(struct UsbPnpNotifyMatchInfoTable), tmpInfo, infoSize) != EOK) {
		453	+ HDF_LOGE("%s: memcpy_s failed", __func__);
		454	+ OsalMemFree(newInfo);
		455	+ return;
		456	+ }
		457	+
		458	+ OsalMemFree(g_testUsbPnpInfo);
		459	+ g_testUsbPnpInfo = newInfo;
444	HDF_LOGI("%s:%d infoSize=%d read success!", __func__, __LINE__, infoSize);	460	HDF_LOGI("%s:%d infoSize=%d read success!", __func__, __LINE__, infoSize);
445	}	461	}
446		462
	@@ -598,6 +614,7 @@ static int32_t UsbPnpNotifyReportThread(void *arg)
598		614
599	g_usbDevice = NULL;	615	g_usbDevice = NULL;
600	#if USB_PNP_NOTIFY_TEST_MODE == true	616	#if USB_PNP_NOTIFY_TEST_MODE == true
		617	+ OsalMemFree(g_testUsbPnpInfo);
601	g_testUsbPnpInfo = NULL;	618	g_testUsbPnpInfo = NULL;
602	#endif	619	#endif
603	OsalMutexUnlock(&g_usbSendEventLock);	620	OsalMutexUnlock(&g_usbSendEventLock);
	@@ -722,7 +739,7 @@ static void UsbPnpNotifyReadPnpInfo(struct HdfSBuf *data)
722	bool flag;	739	bool flag;
723		740
724	flag = HdfSbufReadBuffer(data, (const void **)(&usbPnpInfo), &infoSize);	741	flag = HdfSbufReadBuffer(data, (const void **)(&usbPnpInfo), &infoSize);
725	- if ((!flag) \|\| (usbPnpInfo == NULL)) {	742	+ if ((!flag) \|\| (usbPnpInfo == NULL) \|\| (infoSize < sizeof(struct UsbPnpAddRemoveInfo))) {
726	HDF_LOGE("%s: fail to read g_usbPnpInfo, flag=%d", __func__, flag);	743	HDF_LOGE("%s: fail to read g_usbPnpInfo, flag=%d", __func__, flag);
727	return;	744	return;
728	}	745	}
	@@ -734,8 +751,6 @@ static void UsbPnpNotifyReadPnpInfo(struct HdfSBuf *data)
734	g_usbPnpInfo.interfaceSubClass = usbPnpInfo->interfaceSubClass;	751	g_usbPnpInfo.interfaceSubClass = usbPnpInfo->interfaceSubClass;
735	g_usbPnpInfo.interfaceProtocol = usbPnpInfo->interfaceProtocol;	752	g_usbPnpInfo.interfaceProtocol = usbPnpInfo->interfaceProtocol;
736		753
737	- g_usbDevice = (struct usb_device *)&g_usbPnpInfo;
738	-
739	infoQueryPara.type = USB_INFO_NORMAL_TYPE;	754	infoQueryPara.type = USB_INFO_NORMAL_TYPE;
740	infoQueryPara.devNum = usbPnpInfo->devNum;	755	infoQueryPara.devNum = usbPnpInfo->devNum;
741	infoQueryPara.busNum = usbPnpInfo->busNum;	756	infoQueryPara.busNum = usbPnpInfo->busNum;
	@@ -809,6 +824,11 @@ static int32_t UsbPnpNotifyDispatch(
809	break;	824	break;
810	case USB_PNP_NOTIFY_REMOVE_TEST:	825	case USB_PNP_NOTIFY_REMOVE_TEST:
811	TestReadPnpInfo(data);	826	TestReadPnpInfo(data);
		827	+ if (g_testUsbPnpInfo == NULL) {
		828	+ HDF_LOGE("%s: g_testUsbPnpInfo is NULL", __func__);
		829	+ ret = HDF_FAILURE;
		830	+ break;
		831	+ }
812	g_usbPnpNotifyRemoveType = g_testUsbPnpInfo->removeType;	832	g_usbPnpNotifyRemoveType = g_testUsbPnpInfo->removeType;
813	wake_up_interruptible(&g_usbPnpNotifyReportWait);	833	wake_up_interruptible(&g_usbPnpNotifyReportWait);
814	break;	834	break;

Madapter/khdf/linux/platform/mipi_dsi/mipi_tx_dev.c+6-6

	@@ -269,7 +269,7 @@ static struct MipiDsiCntlr GetCntlrFromFilep(struct file filep)
269	HDF_LOGE("GetCntlrFromFilep: filep is invalid!");	269	HDF_LOGE("GetCntlrFromFilep: filep is invalid!");
270	return NULL;	270	return NULL;
271	}	271	}
272	- id = GetId();	272	+ id = GetIdFromFilep(filep);
273		273
274	return g_vfsPara[id].cntlr;	274	return g_vfsPara[id].cntlr;
275	}	275	}
	@@ -281,7 +281,7 @@ static struct semaphore GetSemaFromFilep(struct file filep)
281	HDF_LOGE("GetSemaFromFilep: filep is invalid!");	281	HDF_LOGE("GetSemaFromFilep: filep is invalid!");
282	return NULL;	282	return NULL;
283	}	283	}
284	- id = GetId();	284	+ id = GetIdFromFilep(filep);
285		285
286	return &g_vfsPara[id].sem;	286	return &g_vfsPara[id].sem;
287	}	287	}
	@@ -293,7 +293,7 @@ static struct MipiCfg GetCfgFromFilep(struct file filep)
293	HDF_LOGE("GetCfgFromFilep: filep is invalid!");	293	HDF_LOGE("GetCfgFromFilep: filep is invalid!");
294	return NULL;	294	return NULL;
295	}	295	}
296	- id = GetId();	296	+ id = GetIdFromFilep(filep);
297	if (g_vfsPara[id].cntlr == NULL) {	297	if (g_vfsPara[id].cntlr == NULL) {
298	HDF_LOGE("GetCfgFromFilep: g_vfsPara[id].cntlr is null!");	298	HDF_LOGE("GetCfgFromFilep: g_vfsPara[id].cntlr is null!");
299	return NULL;	299	return NULL;
	@@ -547,10 +547,10 @@ static int MipiDsiDevOpen(struct inode inode, struct file filep)
547	{	547	{
548	uint8_t id;	548	uint8_t id;
549	(void)inode;	549	(void)inode;
550	- (void)filep;
551		550
552	id = GetId();	551	id = GetId();
553	g_vfsPara[id].cntlr = MipiDsiCntlrOpen(id);	552	g_vfsPara[id].cntlr = MipiDsiCntlrOpen(id);
		553	+ filep->private_data = (void *)(uintptr_t)id;
554	HDF_LOGI("MipiDsiDevOpen: success!");	554	HDF_LOGI("MipiDsiDevOpen: success!");
555		555
556	return 0;	556	return 0;
	@@ -560,11 +560,11 @@ static int MipiDsiDevRelease(struct inode inode, struct file filep)
560	{	560	{
561	uint8_t id;	561	uint8_t id;
562	(void)inode;	562	(void)inode;
563	- (void)filep;
564		563
565	- id = GetId();	564	+ id = GetIdFromFilep(filep);
566	if (g_vfsPara[id].cntlr != NULL) {	565	if (g_vfsPara[id].cntlr != NULL) {
567	MipiDsiCntlrClose(g_vfsPara[id].cntlr);	566	MipiDsiCntlrClose(g_vfsPara[id].cntlr);
		567	+ g_vfsPara[id].cntlr = NULL;
568	}	568	}
569	HDF_LOGI("MipiDsiDevRelease: success!");	569	HDF_LOGI("MipiDsiDevRelease: success!");
570	return 0;	570	return 0;

Madapter/khdf/liteos/model/usb/host/src/usb_pnp_notify.c+31-11

	@@ -357,22 +357,23 @@ static int32_t UsbPnpNotifyGetDeviceInfo(
357	void eventData, union UsbPnpDeviceInfoData pnpInfoData, struct UsbPnpDeviceInfo **deviceInfo)	357	void eventData, union UsbPnpDeviceInfoData pnpInfoData, struct UsbPnpDeviceInfo **deviceInfo)
358	{	358	{
359	struct UsbInfoQueryPara infoQueryPara;	359	struct UsbInfoQueryPara infoQueryPara;
		360	+ int32_t cmdType = g_usbPnpNotifyCmdType;
360		361
361	- if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|	362	+ if ((cmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|
362	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {	363	+ (cmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {
363	pnpInfoData->infoData = (struct UsbPnpAddRemoveInfo *)eventData;	364	pnpInfoData->infoData = (struct UsbPnpAddRemoveInfo *)eventData;
364	} else {	365	} else {
365	pnpInfoData->usbDev = (struct usb_device *)eventData;	366	pnpInfoData->usbDev = (struct usb_device *)eventData;
366	}	367	}
367		368
368	- if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|	369	+ if ((cmdType == USB_PNP_NOTIFY_ADD_INTERFACE) \|\|
369	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {	370	+ (cmdType == USB_PNP_NOTIFY_REMOVE_INTERFACE)) {
370	infoQueryPara.type = USB_INFO_NORMAL_TYPE;	371	infoQueryPara.type = USB_INFO_NORMAL_TYPE;
371	infoQueryPara.devNum = pnpInfoData->infoData->devNum;	372	infoQueryPara.devNum = pnpInfoData->infoData->devNum;
372	infoQueryPara.busNum = pnpInfoData->infoData->busNum;	373	infoQueryPara.busNum = pnpInfoData->infoData->busNum;
373	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);	374	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);
374	- } else if ((g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_ADD_DEVICE) \|\|	375	+ } else if ((cmdType == USB_PNP_NOTIFY_ADD_DEVICE) \|\|
375	- (g_usbPnpNotifyCmdType == USB_PNP_NOTIFY_REMOVE_DEVICE)) {	376	+ (cmdType == USB_PNP_NOTIFY_REMOVE_DEVICE)) {
376	infoQueryPara.type = USB_INFO_DEVICE_ADDRESS_TYPE;	377	infoQueryPara.type = USB_INFO_DEVICE_ADDRESS_TYPE;
377	infoQueryPara.usbDevAddr = (uint64_t)pnpInfoData->usbDev;	378	infoQueryPara.usbDevAddr = (uint64_t)pnpInfoData->usbDev;
378	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);	379	*deviceInfo = UsbPnpNotifyFindInfo(infoQueryPara);
	@@ -454,13 +455,28 @@ static void TestReadPnpInfo(struct HdfSBuf *data)
454	{	455	{
455	uint32_t infoSize;	456	uint32_t infoSize;
456	bool flag;	457	bool flag;
		458	+ const struct UsbPnpNotifyMatchInfoTable *tmpInfo = NULL;
457		459
458	- flag = HdfSbufReadBuffer(data, (const void **)(&g_testUsbPnpInfo), &infoSize);	460	+ flag = HdfSbufReadBuffer(data, (const void **)(&tmpInfo), &infoSize);
459	- if ((!flag) \|\| (g_testUsbPnpInfo == NULL)) {	461	+ if ((!flag) \|\| (tmpInfo == NULL) \|\| (infoSize < sizeof(struct UsbPnpNotifyMatchInfoTable))) {
460	HDF_LOGE("%s: fail to read g_testUsbPnpInfo, flag=%d", __func__, flag);	462	HDF_LOGE("%s: fail to read g_testUsbPnpInfo, flag=%d", __func__, flag);
461	return;	463	return;
462	}	464	}
463		465
		466	+ struct UsbPnpNotifyMatchInfoTable *newInfo =
		467	+ (struct UsbPnpNotifyMatchInfoTable *)OsalMemCalloc(sizeof(struct UsbPnpNotifyMatchInfoTable));
		468	+ if (newInfo == NULL) {
		469	+ HDF_LOGE("%s: alloc failed", __func__);
		470	+ return;
		471	+ }
		472	+ if (memcpy_s(newInfo, sizeof(struct UsbPnpNotifyMatchInfoTable), tmpInfo, infoSize) != EOK) {
		473	+ HDF_LOGE("%s: memcpy_s failed", __func__);
		474	+ OsalMemFree(newInfo);
		475	+ return;
		476	+ }
		477	+
		478	+ OsalMemFree(g_testUsbPnpInfo);
		479	+ g_testUsbPnpInfo = newInfo;
464	HDF_LOGI("%s:%d infoSize=%d g_testUsbPnpInfo read success!", __func__, __LINE__, infoSize);	480	HDF_LOGI("%s:%d infoSize=%d g_testUsbPnpInfo read success!", __func__, __LINE__, infoSize);
465	}	481	}
466		482
	@@ -601,6 +617,7 @@ static int32_t UsbPnpNotifyReportThread(void *arg)
601		617
602	g_usbDevice = NULL;	618	g_usbDevice = NULL;
603	#if USB_PNP_NOTIFY_TEST_MODE == true	619	#if USB_PNP_NOTIFY_TEST_MODE == true
		620	+ OsalMemFree(g_testUsbPnpInfo);
604	g_testUsbPnpInfo = NULL;	621	g_testUsbPnpInfo = NULL;
605	#endif	622	#endif
606	OsalMutexUnlock(&g_usbSendEventLock);	623	OsalMutexUnlock(&g_usbSendEventLock);
	@@ -768,7 +785,7 @@ static void UsbPnpNotifyReadPnpInfo(struct HdfSBuf *data)
768	bool flag;	785	bool flag;
769		786
770	flag = HdfSbufReadBuffer(data, (const void **)(&usbPnpInfo), &infoSize);	787	flag = HdfSbufReadBuffer(data, (const void **)(&usbPnpInfo), &infoSize);
771	- if ((!flag) \|\| (usbPnpInfo == NULL)) {	788	+ if ((!flag) \|\| (usbPnpInfo == NULL) \|\| (infoSize < sizeof(struct UsbPnpAddRemoveInfo))) {
772	HDF_LOGE("%s:%d fail to read g_usbPnpInfo, flag=%d", __func__, __LINE__, flag);	789	HDF_LOGE("%s:%d fail to read g_usbPnpInfo, flag=%d", __func__, __LINE__, flag);
773	return;	790	return;
774	}	791	}
	@@ -780,8 +797,6 @@ static void UsbPnpNotifyReadPnpInfo(struct HdfSBuf *data)
780	g_usbPnpInfo.interfaceSubClass = usbPnpInfo->interfaceSubClass;	797	g_usbPnpInfo.interfaceSubClass = usbPnpInfo->interfaceSubClass;
781	g_usbPnpInfo.interfaceProtocol = usbPnpInfo->interfaceProtocol;	798	g_usbPnpInfo.interfaceProtocol = usbPnpInfo->interfaceProtocol;
782		799
783	- g_usbDevice = (struct usb_device *)&g_usbPnpInfo;
784	-
785	infoQueryPara.type = USB_INFO_NORMAL_TYPE;	800	infoQueryPara.type = USB_INFO_NORMAL_TYPE;
786	infoQueryPara.devNum = usbPnpInfo->devNum;	801	infoQueryPara.devNum = usbPnpInfo->devNum;
787	infoQueryPara.busNum = usbPnpInfo->busNum;	802	infoQueryPara.busNum = usbPnpInfo->busNum;
	@@ -900,6 +915,11 @@ static int32_t UsbPnpNotifyDispatch(
900	break;	915	break;
901	case USB_PNP_NOTIFY_REMOVE_TEST:	916	case USB_PNP_NOTIFY_REMOVE_TEST:
902	TestReadPnpInfo(data);	917	TestReadPnpInfo(data);
		918	+ if (g_testUsbPnpInfo == NULL) {
		919	+ HDF_LOGE("%s: g_testUsbPnpInfo is NULL", __func__);
		920	+ ret = HDF_FAILURE;
		921	+ break;
		922	+ }
903	g_usbPnpNotifyRemoveType = g_testUsbPnpInfo->removeType;	923	g_usbPnpNotifyRemoveType = g_testUsbPnpInfo->removeType;
904	wake_up_interruptible(&g_usbPnpNotifyReportWait);	924	wake_up_interruptible(&g_usbPnpNotifyReportWait);
905	break;	925	break;

Madapter/khdf/liteos/platform/src/i2c_dev.c+19-0

	@@ -57,6 +57,10 @@ static inline int32_t I2cMsgInitFromUser(struct I2cMsg kMsgs, struct i2c_msg u
57	if ((uMsgs->flags & I2C_M_RD) != 0) {	57	if ((uMsgs->flags & I2C_M_RD) != 0) {
58	return HDF_SUCCESS;	58	return HDF_SUCCESS;
59	}	59	}
		60	+ if (!LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(uMsgs->buf), uMsgs->len)) {
		61	+ HDF_LOGE("I2cMsgInitFromUser: uMsgs->buf not in user space!");
		62	+ return HDF_ERR_INVALID_PARAM;
		63	+ }
60	ret = LOS_CopyToKernel((void )(kMsgs->buf), kMsgs->len, (void )(uMsgs->buf), uMsgs->len);	64	ret = LOS_CopyToKernel((void )(kMsgs->buf), kMsgs->len, (void )(uMsgs->buf), uMsgs->len);
61	return (ret == LOS_OK) ? HDF_SUCCESS : HDF_ERR_IO;	65	return (ret == LOS_OK) ? HDF_SUCCESS : HDF_ERR_IO;
62	}	66	}
	@@ -68,6 +72,10 @@ static inline int32_t I2cMsgBackToUser(struct I2cMsg kMsgs, struct i2c_msg uMs
68	if ((kMsgs->flags & I2C_M_RD) == 0) {	72	if ((kMsgs->flags & I2C_M_RD) == 0) {
69	return HDF_SUCCESS;	73	return HDF_SUCCESS;
70	}	74	}
		75	+ if (!LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(uMsgs->buf), uMsgs->len)) {
		76	+ HDF_LOGE("I2cMsgBackToUser: uMsgs->buf not in user space!");
		77	+ return HDF_ERR_INVALID_PARAM;
		78	+ }
71	ret = LOS_CopyFromKernel((void )(uMsgs->buf), uMsgs->len, (void )(kMsgs->buf), kMsgs->len);	79	ret = LOS_CopyFromKernel((void )(uMsgs->buf), uMsgs->len, (void )(kMsgs->buf), kMsgs->len);
72	return (ret == LOS_OK) ? HDF_SUCCESS : HDF_ERR_IO;	80	return (ret == LOS_OK) ? HDF_SUCCESS : HDF_ERR_IO;
73	}	81	}
	@@ -116,6 +124,12 @@ static int32_t I2cMsgsCreateFromUser(I2cIoctlWrap *wrap,
116	}	124	}
117	kMsgs = (struct I2cMsg )((uint8_t )uMsgs + sizeof(uMsgs) wrap->nmsgs);	125	kMsgs = (struct I2cMsg )((uint8_t )uMsgs + sizeof(uMsgs) wrap->nmsgs);
118		126
		127	+ if (!LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(wrap->msgs),
		128	+ sizeof(uMsgs) wrap->nmsgs)) {
		129	+ HDF_LOGE("I2cMsgsCreateFromUser: wrap->msgs not in user space!");
		130	+ ret = HDF_ERR_INVALID_PARAM;
		131	+ goto __ERR__;
		132	+ }
119	ret = LOS_CopyToKernel((void )uMsgs, sizeof(uMsgs) * wrap->nmsgs,	133	ret = LOS_CopyToKernel((void )uMsgs, sizeof(uMsgs) * wrap->nmsgs,
120	(void )wrap->msgs, sizeof(uMsgs) * wrap->nmsgs);	134	(void )wrap->msgs, sizeof(uMsgs) * wrap->nmsgs);
121	if (ret != LOS_OK) {	135	if (ret != LOS_OK) {
	@@ -261,6 +275,11 @@ static int I2cIoctlReadWrite(const struct I2cClient client, const void arg)
261	return HDF_ERR_INVALID_PARAM;	275	return HDF_ERR_INVALID_PARAM;
262	}	276	}
263		277
		278	+ if (!LOS_IsUserAddressRange((vaddr_t)(uintptr_t)arg, sizeof(wrap))) {
		279	+ HDF_LOGE("I2cIoctlReadWrite: arg not in user space!");
		280	+ return HDF_ERR_INVALID_PARAM;
		281	+ }
		282	+
264	ret = LOS_CopyToKernel(&wrap, sizeof(wrap), (void *)arg, sizeof(wrap));	283	ret = LOS_CopyToKernel(&wrap, sizeof(wrap), (void *)arg, sizeof(wrap));
265	if (ret != LOS_OK) {	284	if (ret != LOS_OK) {
266	HDF_LOGE("I2cIoctlReadWrite: copy wrap fail!");	285	HDF_LOGE("I2cIoctlReadWrite: copy wrap fail!");

Madapter/khdf/liteos/platform/src/spi_dev.c+32-6

	@@ -248,6 +248,12 @@ static struct SpiMsg SpiDevGetSpiMsgFromUser(struct SpiIocMsg umsg)
248	HDF_LOGE("SpiDevGetSpiMsgFromUser: melloc msg error!");	248	HDF_LOGE("SpiDevGetSpiMsgFromUser: melloc msg error!");
249	return NULL;	249	return NULL;
250	}	250	}
		251	+ if (!LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(umsg->msg),
		252	+ sizeof(struct SpiMsg) * count)) {
		253	+ HDF_LOGE("SpiDevGetSpiMsgFromUser: umsg->msg not in user space!");
		254	+ OsalMemFree(msg);
		255	+ return NULL;
		256	+ }
251	ret = LOS_CopyToKernel((void )msg, sizeof(struct SpiMsg) count,	257	ret = LOS_CopyToKernel((void )msg, sizeof(struct SpiMsg) count,
252	(void )(umsg->msg), sizeof(struct SpiMsg) count);	258	(void )(umsg->msg), sizeof(struct SpiMsg) count);
253	if (ret != 0) {	259	if (ret != 0) {
	@@ -267,6 +273,10 @@ static int32_t SpiDevRealTransfer(struct SpiDev dev, struct SpiMsg msg, struct
267	uint8_t *rbuf = NULL;	273	uint8_t *rbuf = NULL;
268		274
269	for (i = 0; i < count; i++) {	275	for (i = 0; i < count; i++) {
		276	+ if (msg[i].len > (uint32_t)(INT32_MAX - len)) {
		277	+ HDF_LOGE("SpiDevRealTransfer: len overflow at msg[%d]!", i);
		278	+ return HDF_ERR_INVALID_PARAM;
		279	+ }
270	len += msg[i].len;	280	len += msg[i].len;
271	}	281	}
272	if (len <= 0) {	282	if (len <= 0) {
	@@ -280,10 +290,18 @@ static int32_t SpiDevRealTransfer(struct SpiDev dev, struct SpiMsg msg, struct
280	}	290	}
281	rbuf = wbuf + sizeof(uint8_t) * len;	291	rbuf = wbuf + sizeof(uint8_t) * len;
282	for (i = 0; i < count; i++) {	292	for (i = 0; i < count; i++) {
283	- if (LOS_CopyToKernel(wbuf + pos, msg[i].len, (void *)msg[i].wbuf, msg[i].len) != 0) {	293	+ if (msg[i].wbuf != NULL &&
284	- HDF_LOGE("SpiDevRealTransfer: copy to kernel error!");	294	+ !LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(msg[i].wbuf), msg[i].len)) {
		295	+ HDF_LOGE("SpiDevRealTransfer: msg[%d].wbuf not in user space!", i);
285	OsalMemFree(wbuf);	296	OsalMemFree(wbuf);
286	- return HDF_ERR_IO;	297	+ return HDF_ERR_INVALID_PARAM;
		298	+ }
		299	+ if (msg[i].wbuf != NULL) {
		300	+ if (LOS_CopyToKernel(wbuf + pos, msg[i].len, (void *)msg[i].wbuf, msg[i].len) != 0) {
		301	+ HDF_LOGE("SpiDevRealTransfer: copy to kernel error!");
		302	+ OsalMemFree(wbuf);
		303	+ return HDF_ERR_IO;
		304	+ }
287	}	305	}
288	kmsg[i].wbuf = wbuf + pos;	306	kmsg[i].wbuf = wbuf + pos;
289	kmsg[i].rbuf = rbuf + pos;	307	kmsg[i].rbuf = rbuf + pos;
	@@ -299,10 +317,18 @@ static int32_t SpiDevRealTransfer(struct SpiDev dev, struct SpiMsg msg, struct
299	return HDF_FAILURE;	317	return HDF_FAILURE;
300	}	318	}
301	for (i = 0; i < count; i++) {	319	for (i = 0; i < count; i++) {
302	- if (LOS_CopyFromKernel((void )msg[i].rbuf, msg[i].len, (void )kmsg[i].rbuf, msg[i].len) != 0) {	320	+ if (msg[i].rbuf != NULL &&
303	- HDF_LOGE("SpiDevRealTransfer: copy from kernel error!");	321	+ !LOS_IsUserAddressRange((vaddr_t)(uintptr_t)(msg[i].rbuf), msg[i].len)) {
		322	+ HDF_LOGE("SpiDevRealTransfer: msg[%d].rbuf not in user space!", i);
304	OsalMemFree(wbuf);	323	OsalMemFree(wbuf);
305	- return HDF_ERR_IO;	324	+ return HDF_ERR_INVALID_PARAM;
		325	+ }
		326	+ if (msg[i].rbuf != NULL) {
		327	+ if (LOS_CopyFromKernel((void )msg[i].rbuf, msg[i].len, (void )kmsg[i].rbuf, msg[i].len) != 0) {
		328	+ HDF_LOGE("SpiDevRealTransfer: copy from kernel error!");
		329	+ OsalMemFree(wbuf);
		330	+ return HDF_ERR_IO;
		331	+ }
306	}	332	}
307	}	333	}
308	OsalMemFree(wbuf);	334	OsalMemFree(wbuf);

Mframework/core/common/src/devmgr_service_start.c+1-0

	@@ -77,6 +77,7 @@ int DeviceManagerDispatch(struct HdfObject stub, int code, struct HdfSBuf data
77	HDF_LOGE("%{public}s: input param is invalid", __func__);	77	HDF_LOGE("%{public}s: input param is invalid", __func__);
78	return ret;	78	return ret;
79	}	79	}
		80	+ HdfSbufFlush(reply);
80	OsalMutexLock(&devMgrSvc->devMgrMutex);	81	OsalMutexLock(&devMgrSvc->devMgrMutex);
81	switch (code) {	82	switch (code) {
82	case DEVMGR_LOAD_SERVICE:	83	case DEVMGR_LOAD_SERVICE:

Mframework/model/audio/common/src/audio_codec_base.c+7-4

	@@ -507,6 +507,12 @@ static int32_t CodecI2cMsgFill(struct I2cTransferParam *i2cTransferParam, const
507	msgs[0].len = i2cTransferParam->i2cRegDataLen + 1;	507	msgs[0].len = i2cTransferParam->i2cRegDataLen + 1;
508	AUDIO_DRIVER_LOG_DEBUG("msgs[0].addr=0x%02x, regs[0]=0x%02x.", msgs[0].addr, regs[0]);	508	AUDIO_DRIVER_LOG_DEBUG("msgs[0].addr=0x%02x, regs[0]=0x%02x.", msgs[0].addr, regs[0]);
509		509
		510	+ if (i2cTransferParam->i2cRegDataLen != I2C_MSG_BUF_SIZE_1 &&
		511	+ i2cTransferParam->i2cRegDataLen != I2C_MSG_BUF_SIZE_2) {
		512	+ AUDIO_DRIVER_LOG_ERR("i2cRegDataLen is invalid");
		513	+ return HDF_FAILURE;
		514	+ }
		515	+
510	if (rwFlag == 0) { // write	516	if (rwFlag == 0) { // write
511	// S 11011A2A1 0 A ADDR A MS1 A LS1 A <....> P	517	// S 11011A2A1 0 A ADDR A MS1 A LS1 A <....> P
512	msgBuf = OsalMemCalloc(i2cTransferParam->i2cRegDataLen + 1);	518	msgBuf = OsalMemCalloc(i2cTransferParam->i2cRegDataLen + 1);
	@@ -517,12 +523,9 @@ static int32_t CodecI2cMsgFill(struct I2cTransferParam *i2cTransferParam, const
517	msgBuf[0] = regs[0];	523	msgBuf[0] = regs[0];
518	if (i2cTransferParam->i2cRegDataLen == I2C_MSG_BUF_SIZE_1) {	524	if (i2cTransferParam->i2cRegDataLen == I2C_MSG_BUF_SIZE_1) {
519	msgBuf[1] = (uint8_t)regAttr->value;	525	msgBuf[1] = (uint8_t)regAttr->value;
520	- } else if (i2cTransferParam->i2cRegDataLen == I2C_MSG_BUF_SIZE_2) {	526	+ } else {
521	msgBuf[1] = (regAttr->value >> COMM_SHIFT_8BIT); // High 8 bit	527	msgBuf[1] = (regAttr->value >> COMM_SHIFT_8BIT); // High 8 bit
522	msgBuf[I2C_MSG_BUF_SIZE_2] = (uint8_t)(regAttr->value & COMM_MASK_FF); // Low 8 bit	528	msgBuf[I2C_MSG_BUF_SIZE_2] = (uint8_t)(regAttr->value & COMM_MASK_FF); // Low 8 bit
523	- } else {
524	- AUDIO_DRIVER_LOG_ERR("i2cRegDataLen is invalid");
525	- return HDF_FAILURE;
526	}	529	}
527	msgs[0].buf = msgBuf;	530	msgs[0].buf = msgBuf;
528	} else {	531	} else {

Mframework/model/network/wifi/core/components/sta/sta.c+5-1

	@@ -418,7 +418,11 @@ static int32_t HdfCmdfillPnoSettings(struct HdfSBuf reqData, WifiPnoSettings
418	HDF_LOGE("%s: %s!ParamName=%s", __func__, ERROR_DESC_READ_REQ_FAILED, "pnoNetworksLen");	418	HDF_LOGE("%s: %s!ParamName=%s", __func__, ERROR_DESC_READ_REQ_FAILED, "pnoNetworksLen");
419	return HDF_FAILURE;	419	return HDF_FAILURE;
420	}	420	}
421	-	421	+ if (pnoSettings->pnoNetworksLen == 0 \|\| pnoSettings->pnoNetworksLen > PNO_NETWORKS_MAX) {
		422	+ HDF_LOGE("%s: %s!ParamName=%s, invalid len %u", __func__, ERROR_DESC_READ_REQ_FAILED, "pnoNetworksLen",
		423	+ pnoSettings->pnoNetworksLen);
		424	+ return HDF_FAILURE;
		425	+ }
422	pnoSettings->pnoNetworks = (WifiPnoNetwork )OsalMemAlloc(sizeof(WifiPnoNetwork) pnoSettings->pnoNetworksLen);	426	pnoSettings->pnoNetworks = (WifiPnoNetwork )OsalMemAlloc(sizeof(WifiPnoNetwork) pnoSettings->pnoNetworksLen);
423	if (pnoSettings->pnoNetworks == NULL) {	427	if (pnoSettings->pnoNetworks == NULL) {
424	HDF_LOGE("%s: alloc memory failed.", __func__);	428	HDF_LOGE("%s: alloc memory failed.", __func__);

Mframework/model/network/wifi/include/hdf_wifi_cmd.h+1-0

	@@ -30,6 +30,7 @@ extern "C" {
30	#define MAX_NR_AKM_SUITES 2	30	#define MAX_NR_AKM_SUITES 2
31	#define WPAS_MAX_SCAN_SSIDS 16	31	#define WPAS_MAX_SCAN_SSIDS 16
32	#define DRIVER_MAX_SCAN_SSIDS 2	32	#define DRIVER_MAX_SCAN_SSIDS 2
		33	+#define PNO_NETWORKS_MAX 16
33		34
34	#define SCAN_AP_LIMIT 64	35	#define SCAN_AP_LIMIT 64
35	#define SCAN_TIME_OUT 5	36	#define SCAN_TIME_OUT 5

Mframework/support/platform/src/spi/spi_core.c+5-0

	@@ -16,6 +16,7 @@
16	#define SPI_TRACE_BASIC_PARAM_NUM 3	16	#define SPI_TRACE_BASIC_PARAM_NUM 3
17	#define SPI_TRACE_PARAM_GET_NUM 3	17	#define SPI_TRACE_PARAM_GET_NUM 3
18	#define HDF_LOG_TAG spi_core	18	#define HDF_LOG_TAG spi_core
		19	+#define HDF_UINT32_MAX 0xffffffffu
19		20
20	int32_t SpiCntlrOpen(struct SpiCntlr *cntlr, uint32_t csNum)	21	int32_t SpiCntlrOpen(struct SpiCntlr *cntlr, uint32_t csNum)
21	{	22	{
	@@ -159,6 +160,10 @@ static int32_t SpiMsgsRwProcess(
159	msgs[i].rbuf = NULL;	160	msgs[i].rbuf = NULL;
160	msgs[i].wbuf = NULL;	161	msgs[i].wbuf = NULL;
161	if ((userMsg->rwFlag & SPI_USER_MSG_READ) == SPI_USER_MSG_READ) {	162	if ((userMsg->rwFlag & SPI_USER_MSG_READ) == SPI_USER_MSG_READ) {
		163	+ if ((*lenReply) > HDF_UINT32_MAX - msgs[i].len) {
		164	+ HDF_LOGE("SpiMsgsRwProcess: lenReply overflow!");
		165	+ return HDF_ERR_INVALID_PARAM;
		166	+ }
162	(*lenReply) += msgs[i].len;	167	(*lenReply) += msgs[i].len;
163	msgs[i].rbuf = tmpFlag; // tmpFlag is not mainpulated, only to mark rbuf not NULL	168	msgs[i].rbuf = tmpFlag; // tmpFlag is not mainpulated, only to mark rbuf not NULL
164	}	169	}