A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa3: fix pointer arithmetic to avoid out-of-bound

Browse source 
When offset gets added to base of the array, it returns
offset plus the number equal to size of the whole array.
So, correct it by passing the address of offset element
in the array.

Change-Id: I8a087ca277bdc476674c7221b5fc0920e6986570
This commit is contained in:
Jagadeesh Ponduru 2023-03-30 13:09:16 +05:30 • committed by Gerrit - the friendly Code Review server
commit 1a170ff917
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
View file

@ -7281,7 +7281,7 @@ void ipa3_counter_remove_hdl(int hdl)
offset = counter->hw_counter.start_id - 1;
if (offset >= 0 && (offset + counter->hw_counter.num_counters)
< IPA_FLT_RT_HW_COUNTER) {
memset(&ipa3_ctx->flt_rt_counters.used_hw + offset,
memset(&ipa3_ctx->flt_rt_counters.used_hw[offset],
0, counter->hw_counter.num_counters * sizeof(bool));
} else {
IPAERR_RL("unexpected hdl %d\n", hdl);
@ -7290,7 +7290,7 @@ void ipa3_counter_remove_hdl(int hdl)
offset = counter->sw_counter.start_id - 1 - IPA_FLT_RT_HW_COUNTER;
if (offset >= 0 && (offset + counter->sw_counter.num_counters)
< IPA_FLT_RT_SW_COUNTER) {
memset(&ipa3_ctx->flt_rt_counters.used_sw + offset,
memset(&ipa3_ctx->flt_rt_counters.used_sw[offset],
0, counter->sw_counter.num_counters * sizeof(bool));
} else {
IPAERR_RL("unexpected hdl %d\n", hdl);