raw/ifpga/base: fix use of untrusted scalar value

[dpdk.git] / drivers / raw / ifpga_rawdev / base / ifpga_fme_pr.c

diff --git a/drivers/raw/ifpga_rawdev/base/ifpga_fme_pr.c b/drivers/raw/ifpga_rawdev/base/ifpga_fme_pr.c
index efa7266..9997942 100644 (file)
--- a/drivers/raw/ifpga_rawdev/base/ifpga_fme_pr.c
+++ b/drivers/raw/ifpga_rawdev/base/ifpga_fme_pr.c
@@ -223,8 +223,8 @@ static int fpga_pr_buf_load(struct ifpga_fme_hw *fme_dev,
        return 0;
 }
 
-static int fme_pr(struct ifpga_hw *hw, u32 port_id, void *buffer, u32 size,
-                 u64 *status)
+static int fme_pr(struct ifpga_hw *hw, u32 port_id, const char *buffer,
+               u32 size, u64 *status)
 {
        struct feature_fme_header *fme_hdr;
        struct feature_fme_capability fme_capability;
@@ -269,7 +269,7 @@ static int fme_pr(struct ifpga_hw *hw, u32 port_id, void *buffer, u32 size,
        /* Disable Port before PR */
        fpga_port_disable(port);
 
-       ret = fpga_pr_buf_load(fme, &info, (void *)buffer, size);
+       ret = fpga_pr_buf_load(fme, &info, buffer, size);
 
        *status = info.pr_err;
 
@@ -280,27 +280,32 @@ static int fme_pr(struct ifpga_hw *hw, u32 port_id, void *buffer, u32 size,
        return ret;
 }
 
-int do_pr(struct ifpga_hw *hw, u32 port_id, void *buffer, u32 size, u64 *status)
+int do_pr(struct ifpga_hw *hw, u32 port_id, const char *buffer,
+               u32 size, u64 *status)
 {
-       struct bts_header *bts_hdr;
-       void *buf;
+       const struct bts_header *bts_hdr;
+       const char *buf;
        struct ifpga_port_hw *port;
        int ret;
+       u32 header_size;
 
        if (!buffer || size == 0) {
                dev_err(hw, "invalid parameter\n");
                return -EINVAL;
        }
 
-       bts_hdr = (struct bts_header *)buffer;
+       bts_hdr = (const struct bts_header *)buffer;
 
        if (is_valid_bts(bts_hdr)) {
                dev_info(hw, "this is a valid bitsteam..\n");
-               size -= (sizeof(struct bts_header) +
-                                    bts_hdr->metadata_len);
-               buf = (u8 *)buffer + sizeof(struct bts_header) +
-                              bts_hdr->metadata_len;
+               header_size = sizeof(struct bts_header) +
+                       bts_hdr->metadata_len;
+               if (size < header_size)
+                       return -EINVAL;
+               size -= header_size;
+               buf = buffer + header_size;
        } else {
+               dev_err(hw, "this is an invalid bitstream..\n");
                return -EINVAL;
        }