VCHIQ: Use unsigned integers for unsigned values

The VCHIQ interface used signed integers for values which are
inherently unsigned. Worse, the parameter validation code treated them
as if they were unsigned, checking for overflow but not underflow.

This patch converts those integers to unsigned integers.

Thanks to Jann Horn.

diff --git a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c
index 54704703da16dfd017a9ec3fcb918a2c0d95579f..2efb12411a6058f20d30ee33d46994ca21b274d0 100644 (file)
--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c
+++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c
@@ -850,7 +850,7 @@ queue_message(VCHIQ_STATE_T *state, VCHIQ_SERVICE_T *service,
                                                VCHIQ_LOG_INFO)
                                                vchiq_log_dump_mem("Sent", 0,
                                                        header->data + pos,
-                                                       min(64,
+                                                       min(64u,
                                                        elements[0].size));
                                }
                        }
@@ -998,7 +998,7 @@ queue_message_sync(VCHIQ_STATE_T *state, VCHIQ_SERVICE_T *service,
                                                VCHIQ_LOG_TRACE)
                                                vchiq_log_dump_mem("Sent Sync",
                                                        0, header->data + pos,
-                                                       min(64,
+                                                       min(64u,
                                                        elements[0].size));
                                }
                        }
@@ -3307,7 +3307,7 @@ error_exit:
 
 VCHIQ_STATUS_T
 vchiq_queue_message(VCHIQ_SERVICE_HANDLE_T handle,
-       const VCHIQ_ELEMENT_T *elements, int count)
+       const VCHIQ_ELEMENT_T *elements, unsigned int count)
 {
        VCHIQ_SERVICE_T *service = find_service_by_handle(handle);
        VCHIQ_STATUS_T status = VCHIQ_ERROR;

diff --git a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_if.h b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_if.h
index c2c2d53f19206ffeda61872aef938800d65502e0..50359b0a4cf027083ab83923e68eec561334e8ad 100644 (file)
--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_if.h
+++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_if.h
@@ -89,7 +89,7 @@ typedef struct vchiq_header_struct {
 
 typedef struct {
        const void *data;
-       int size;
+       unsigned int size;
 } VCHIQ_ELEMENT_T;
 
 typedef unsigned int VCHIQ_SERVICE_HANDLE_T;
@@ -112,11 +112,12 @@ typedef struct vchiq_service_params_struct {
 } VCHIQ_SERVICE_PARAMS_T;
 
 typedef struct vchiq_config_struct {
-       int max_msg_size;
-       int bulk_threshold; /* The message size aboce which it is better to use
-                               a bulk transfer (<= max_msg_size) */
-       int max_outstanding_bulks;
-       int max_services;
+       unsigned int max_msg_size;
+       unsigned int bulk_threshold; /* The message size above which it
+                                       is better to use a bulk transfer
+                                       (<= max_msg_size) */
+       unsigned int max_outstanding_bulks;
+       unsigned int max_services;
        short version;      /* The version of VCHIQ */
        short version_min;  /* The minimum compatible version of VCHIQ */
 } VCHIQ_CONFIG_T;
@@ -141,29 +142,31 @@ extern VCHIQ_STATUS_T vchiq_use_service_no_resume(
 extern VCHIQ_STATUS_T vchiq_release_service(VCHIQ_SERVICE_HANDLE_T service);
 
 extern VCHIQ_STATUS_T vchiq_queue_message(VCHIQ_SERVICE_HANDLE_T service,
-       const VCHIQ_ELEMENT_T *elements, int count);
+       const VCHIQ_ELEMENT_T *elements, unsigned int count);
 extern void           vchiq_release_message(VCHIQ_SERVICE_HANDLE_T service,
        VCHIQ_HEADER_T *header);
 extern VCHIQ_STATUS_T vchiq_queue_bulk_transmit(VCHIQ_SERVICE_HANDLE_T service,
-       const void *data, int size, void *userdata);
+       const void *data, unsigned int size, void *userdata);
 extern VCHIQ_STATUS_T vchiq_queue_bulk_receive(VCHIQ_SERVICE_HANDLE_T service,
-       void *data, int size, void *userdata);
+       void *data, unsigned int size, void *userdata);
 extern VCHIQ_STATUS_T vchiq_queue_bulk_transmit_handle(
        VCHIQ_SERVICE_HANDLE_T service, VCHI_MEM_HANDLE_T handle,
-       const void *offset, int size, void *userdata);
+       const void *offset, unsigned int size, void *userdata);
 extern VCHIQ_STATUS_T vchiq_queue_bulk_receive_handle(
        VCHIQ_SERVICE_HANDLE_T service, VCHI_MEM_HANDLE_T handle,
-       void *offset, int size, void *userdata);
+       void *offset, unsigned int size, void *userdata);
 extern VCHIQ_STATUS_T vchiq_bulk_transmit(VCHIQ_SERVICE_HANDLE_T service,
-       const void *data, int size, void *userdata, VCHIQ_BULK_MODE_T mode);
+       const void *data, unsigned int size, void *userdata,
+       VCHIQ_BULK_MODE_T mode);
 extern VCHIQ_STATUS_T vchiq_bulk_receive(VCHIQ_SERVICE_HANDLE_T service,
-       void *data, int size, void *userdata, VCHIQ_BULK_MODE_T mode);
-extern VCHIQ_STATUS_T vchiq_bulk_transmit_handle(VCHIQ_SERVICE_HANDLE_T service,
-       VCHI_MEM_HANDLE_T handle, const void *offset, int size, void *userdata,
+       void *data, unsigned int size, void *userdata,
        VCHIQ_BULK_MODE_T mode);
+extern VCHIQ_STATUS_T vchiq_bulk_transmit_handle(VCHIQ_SERVICE_HANDLE_T service,
+       VCHI_MEM_HANDLE_T handle, const void *offset, unsigned int size,
+       void *userdata, VCHIQ_BULK_MODE_T mode);
 extern VCHIQ_STATUS_T vchiq_bulk_receive_handle(VCHIQ_SERVICE_HANDLE_T service,
-       VCHI_MEM_HANDLE_T handle, void *offset, int size, void *userdata,
-       VCHIQ_BULK_MODE_T mode);
+       VCHI_MEM_HANDLE_T handle, void *offset, unsigned int size,
+       void *userdata, VCHIQ_BULK_MODE_T mode);
 extern int   vchiq_get_client_id(VCHIQ_SERVICE_HANDLE_T service);
 extern void *vchiq_get_service_userdata(VCHIQ_SERVICE_HANDLE_T service);
 extern int   vchiq_get_service_fourcc(VCHIQ_SERVICE_HANDLE_T service);

diff --git a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_ioctl.h b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_ioctl.h
index c5a01587415fc3fcc590ea8cbf8f875a505e5106..e2480375b82f9078f3cd97d20f7914b37299c311 100644 (file)
--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_ioctl.h
+++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_ioctl.h
@@ -38,25 +38,25 @@
 #include "vchiq_if.h"
 
 #define VCHIQ_IOC_MAGIC 0xc4
-#define VCHIQ_INVALID_HANDLE -1
+#define VCHIQ_INVALID_HANDLE (~0)
 
 typedef struct {
        VCHIQ_SERVICE_PARAMS_T params;
        int is_open;
        int is_vchi;
-       int handle;       /* OUT */
+       unsigned int handle;       /* OUT */
 } VCHIQ_CREATE_SERVICE_T;
 
 typedef struct {
-       int handle;
-       int count;
+       unsigned int handle;
+       unsigned int count;
        const VCHIQ_ELEMENT_T *elements;
 } VCHIQ_QUEUE_MESSAGE_T;
 
 typedef struct {
-       int handle;
+       unsigned int handle;
        void *data;
-       int size;
+       unsigned int size;
        void *userdata;
        VCHIQ_BULK_MODE_T mode;
 } VCHIQ_QUEUE_BULK_TRANSFER_T;
@@ -69,27 +69,27 @@ typedef struct {
 } VCHIQ_COMPLETION_DATA_T;
 
 typedef struct {
-       int count;
+       unsigned int count;
        VCHIQ_COMPLETION_DATA_T *buf;
-       int msgbufsize;
-       int msgbufcount; /* IN/OUT */
+       unsigned int msgbufsize;
+       unsigned int msgbufcount; /* IN/OUT */
        void **msgbufs;
 } VCHIQ_AWAIT_COMPLETION_T;
 
 typedef struct {
-       int handle;
+       unsigned int handle;
        int blocking;
-       int bufsize;
+       unsigned int bufsize;
        void *buf;
 } VCHIQ_DEQUEUE_MESSAGE_T;
 
 typedef struct {
-       int config_size;
+       unsigned int config_size;
        VCHIQ_CONFIG_T *pconfig;
 } VCHIQ_GET_CONFIG_T;
 
 typedef struct {
-       int handle;
+       unsigned int handle;
        VCHIQ_SERVICE_OPTION_T option;
        int value;
 } VCHIQ_SET_SERVICE_OPTION_T;

diff --git a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_kern_lib.c b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_kern_lib.c
index 36b3d343e08feb66b1c10fc2e4e5d2859ca850ad..62965c65d2b5660f38e01cfa5bbae44dc152daec 100644 (file)
--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_kern_lib.c
+++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_kern_lib.c
@@ -61,7 +61,7 @@ struct vchiq_instance_struct {
 
 static VCHIQ_STATUS_T
 vchiq_blocking_bulk_transfer(VCHIQ_SERVICE_HANDLE_T handle, void *data,
-       int size, VCHIQ_BULK_DIR_T dir);
+       unsigned int size, VCHIQ_BULK_DIR_T dir);
 
 /****************************************************************************
 *
@@ -302,7 +302,7 @@ EXPORT_SYMBOL(vchiq_open_service);
 
 VCHIQ_STATUS_T
 vchiq_queue_bulk_transmit(VCHIQ_SERVICE_HANDLE_T handle,
-       const void *data, int size, void *userdata)
+       const void *data, unsigned int size, void *userdata)
 {
        return vchiq_bulk_transfer(handle,
                VCHI_MEM_HANDLE_INVALID, (void *)data, size, userdata,
@@ -311,8 +311,8 @@ vchiq_queue_bulk_transmit(VCHIQ_SERVICE_HANDLE_T handle,
 EXPORT_SYMBOL(vchiq_queue_bulk_transmit);
 
 VCHIQ_STATUS_T
-vchiq_queue_bulk_receive(VCHIQ_SERVICE_HANDLE_T handle, void *data, int size,
-       void *userdata)
+vchiq_queue_bulk_receive(VCHIQ_SERVICE_HANDLE_T handle, void *data,
+       unsigned int size, void *userdata)
 {
        return vchiq_bulk_transfer(handle,
                VCHI_MEM_HANDLE_INVALID, data, size, userdata,
@@ -321,8 +321,8 @@ vchiq_queue_bulk_receive(VCHIQ_SERVICE_HANDLE_T handle, void *data, int size,
 EXPORT_SYMBOL(vchiq_queue_bulk_receive);
 
 VCHIQ_STATUS_T
-vchiq_bulk_transmit(VCHIQ_SERVICE_HANDLE_T handle, const void *data, int size,
-       void *userdata, VCHIQ_BULK_MODE_T mode)
+vchiq_bulk_transmit(VCHIQ_SERVICE_HANDLE_T handle, const void *data,
+       unsigned int size, void *userdata, VCHIQ_BULK_MODE_T mode)
 {
        VCHIQ_STATUS_T status;
 
@@ -346,8 +346,8 @@ vchiq_bulk_transmit(VCHIQ_SERVICE_HANDLE_T handle, const void *data, int size,
 EXPORT_SYMBOL(vchiq_bulk_transmit);
 
 VCHIQ_STATUS_T
-vchiq_bulk_receive(VCHIQ_SERVICE_HANDLE_T handle, void *data, int size,
-       void *userdata, VCHIQ_BULK_MODE_T mode)
+vchiq_bulk_receive(VCHIQ_SERVICE_HANDLE_T handle, void *data,
+       unsigned int size, void *userdata, VCHIQ_BULK_MODE_T mode)
 {
        VCHIQ_STATUS_T status;
 
@@ -372,7 +372,7 @@ EXPORT_SYMBOL(vchiq_bulk_receive);
 
 static VCHIQ_STATUS_T
 vchiq_blocking_bulk_transfer(VCHIQ_SERVICE_HANDLE_T handle, void *data,
-       int size, VCHIQ_BULK_DIR_T dir)
+       unsigned int size, VCHIQ_BULK_DIR_T dir)
 {
        VCHIQ_INSTANCE_T instance;
        VCHIQ_SERVICE_T *service;