A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa4: Fix using of tag_desc

Browse source 
While sending imm cmd to close the coal pipe,
we program desc to close the frame instead of tag_desc.
This lead to memory corruption. Add changes to use
tag_desc.

Change-Id: I10e9f50f48a14cc77f5032e297996f7e162517b2
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
This commit is contained in:
Praveen Kurapati 2020-01-07 10:48:53 +05:30 • committed by Gerrit - the friendly Code Review server
commit 6545be53e8
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
View file

@ -6609,11 +6609,20 @@ int ipa3_tag_process(struct ipa3_desc desc[],
u32 retry_cnt = 0;
struct ipahal_reg_valmask valmask;
struct ipahal_imm_cmd_register_write reg_write_coal_close;
int req_num_tag_desc = REQUIRED_TAG_PROCESS_DESCRIPTORS;
/**
* We use a descriptor for closing coalsceing endpoint
* by immediate command. So, REQUIRED_TAG_PROCESS_DESCRIPTORS
* should be incremented by 1 to overcome buffer overflow.
*/
if (ipa3_get_ep_mapping(IPA_CLIENT_APPS_WAN_COAL_CONS) != -1)
req_num_tag_desc += 1;
/* Not enough room for the required descriptors for the tag process */
if (IPA_TAG_MAX_DESC - descs_num < REQUIRED_TAG_PROCESS_DESCRIPTORS) {
if (IPA_TAG_MAX_DESC - descs_num < req_num_tag_desc) {
IPAERR("up to %d descriptors are allowed (received %d)\n",
IPA_TAG_MAX_DESC - REQUIRED_TAG_PROCESS_DESCRIPTORS,
IPA_TAG_MAX_DESC - req_num_tag_desc,
descs_num);
return -ENOMEM;
}
@ -6662,8 +6671,8 @@ int ipa3_tag_process(struct ipa3_desc desc[],
goto fail_free_tag_desc;
}
ipa3_init_imm_cmd_desc(&tag_desc[desc_idx], cmd_pyld);
desc[desc_idx].callback = ipa3_tag_destroy_imm;
desc[desc_idx].user1 = cmd_pyld;
tag_desc[desc_idx].callback = ipa3_tag_destroy_imm;
tag_desc[desc_idx].user1 = cmd_pyld;
++desc_idx;
}
@ -6803,7 +6812,7 @@ fail_free_desc:
* of the initial allocations above
*/
for (i = descs_num;
i < min(REQUIRED_TAG_PROCESS_DESCRIPTORS, desc_idx); i++)
i < min(req_num_tag_desc, desc_idx); i++)
if (tag_desc[i].callback)
tag_desc[i].callback(tag_desc[i].user1,
tag_desc[i].user2);