From f3f8ee6701f9559e99a4f113abe3d553d241425a Mon Sep 17 00:00:00 2001 From: Praveen Kurapati Date: Thu, 24 Oct 2019 20:08:31 +0530 Subject: [PATCH] msm: ipa4: Fix to overcome KW issues Correct the validation of number of dma entries in DMA table to overcome the out-of-bounds access to dma buffers array. And make changes to initialize an uninitialized variable which may contain junk data. Change-Id: Ia05082c887548e58831ab7dfae42cba97ec13fec Signed-off-by: Praveen Kurapati --- drivers/platform/msm/ipa/ipa_v3/ipa_nat.c | 12 +++++++++++- drivers/platform/msm/ipa/ipa_v3/ipa_utils.c | 2 +- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_nat.c b/drivers/platform/msm/ipa/ipa_v3/ipa_nat.c index 91715e5ddff0..583174061ca3 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_nat.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_nat.c @@ -1365,14 +1365,24 @@ int ipa3_table_dma_cmd(struct ipa_ioc_nat_dma_cmd *dma) int i; struct ipahal_reg_valmask valmask; struct ipahal_imm_cmd_register_write reg_write_coal_close; + int max_dma_table_cmds = IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC; IPADBG("\n"); memset(desc, 0, sizeof(desc)); memset(cmd_pyld, 0, sizeof(cmd_pyld)); + /** + * We use a descriptor for closing coalsceing endpoint + * by immediate command. So, DMA entries should be less than + * IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC - 1 to overcome + * buffer overflow of ipa3_desc array. + */ + if (ipa3_get_ep_mapping(IPA_CLIENT_APPS_WAN_COAL_CONS) != -1) + max_dma_table_cmds -= 1; + if (!dma->entries || - dma->entries >= IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC) { + dma->entries > (max_dma_table_cmds - 1)) { IPAERR_RL("Invalid number of entries %d\n", dma->entries); result = -EPERM; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c index a38d20e852d3..25037ef7d387 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c @@ -6623,7 +6623,7 @@ int ipa3_tag_process(struct ipa3_desc desc[], struct ipahal_imm_cmd_ip_packet_tag_status status; int i; struct sk_buff *dummy_skb; - int res; + int res = 0; struct ipa3_tag_completion *comp; int ep_idx; u32 retry_cnt = 0;