From 719233800c2595c103d92f7d1f444037e363e9e0 Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Thu, 10 Jun 2021 23:38:33 +0530 Subject: [PATCH 1/7] msm: ipa3: Disable HOLB for ODL pipe during suspend 1. Disable HOLB for ODL pipe during suspend to avoid dropping the packet 2. Enable HOLB while unsuspend the pipes. 3. Enable drop stats for ODL pipe. Change-Id: Id0a5871ebe4a0925c60dea39f197af9e1892d05e Signed-off-by: Ashok Vuyyuru ep[odl_ep_idx].valid) { + memset(&holb_cfg, 0, sizeof(holb_cfg)); + if (suspend) + holb_cfg.en = 0; + else + holb_cfg.en = 1; + + ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n, + odl_ep_idx, &holb_cfg); + /* IPA4.5 issue requires HOLB_EN to be written twice */ + if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_5 && holb_cfg.en) + ipahal_write_reg_n_fields( + IPA_ENDP_INIT_HOL_BLOCK_EN_n, + odl_ep_idx, &holb_cfg); + + } + res = _ipa_suspend_resume_pipe(IPA_CLIENT_APPS_WAN_LOW_LAT_CONS, suspend); if (res == -EAGAIN) From bf9c2b116819c754ebf0ce308fbdcccc528bb16a Mon Sep 17 00:00:00 2001 From: Goutam Bose Date: Wed, 30 Jun 2021 11:43:45 +0530 Subject: [PATCH 2/7] msm: ipa: fix use-after-free of rt_tbl Fix use-after-free of rt_tbl in __ipa_del_flt_rule by checking if the rt_tbl is already freed. Change-Id: I09541f65f474dc42f262c603d99f6bbcbb0ce8ec Signed-off-by: Goutam Bose --- drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c index 4aeab4968f2a..f71b4346b186 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c @@ -1078,7 +1078,7 @@ static int __ipa_del_flt_rule(u32 rule_hdl) list_del(&entry->link); entry->tbl->rule_cnt--; - if (entry->rt_tbl) + if (entry->rt_tbl && !ipa3_check_idr_if_freed(entry->rt_tbl)) entry->rt_tbl->ref_cnt--; IPADBG("del flt rule rule_cnt=%d rule_id=%d\n", entry->tbl->rule_cnt, entry->rule_id); From 50e1ec6d093ce6da472dceed4011c3de82f7d434 Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Mon, 2 Aug 2021 23:55:50 +0530 Subject: [PATCH 3/7] msm: ipa3: Changes to remove the CNTXT_SCRATCH_1 config Context scratch 1 register configuration not required, So removing these changes. Change-Id: I91e336b1a37959cd20024170694db5c4498c13d7 Signed-off-by: Ashok Vuyyuru --- drivers/platform/msm/gsi/gsi.c | 4 ---- drivers/platform/msm/gsi/gsi_reg_v1.h | 5 ----- drivers/platform/msm/gsi/gsi_reg_v2.h | 5 ----- 3 files changed, 14 deletions(-) diff --git a/drivers/platform/msm/gsi/gsi.c b/drivers/platform/msm/gsi/gsi.c index d9bd57f9b3b2..6663e79dc528 100644 --- a/drivers/platform/msm/gsi/gsi.c +++ b/drivers/platform/msm/gsi/gsi.c @@ -1367,10 +1367,6 @@ int gsi_register_device(struct gsi_per_props *props, unsigned long *dev_hdl) gsi_writel(0, gsi_ctx->base + GSI_EE_n_ERROR_LOG_OFFS(gsi_ctx->per.ee)); - /* Reset to zero scratch_1 register*/ - gsi_writel(0, gsi_ctx->base + - GSI_EE_n_CNTXT_SCRATCH_1_OFFS(gsi_ctx->per.ee)); - if (running_emulation) { /* * Set up the emulator's interrupt controller... diff --git a/drivers/platform/msm/gsi/gsi_reg_v1.h b/drivers/platform/msm/gsi/gsi_reg_v1.h index ee3de12fa3f8..8d3052f4db34 100644 --- a/drivers/platform/msm/gsi/gsi_reg_v1.h +++ b/drivers/platform/msm/gsi/gsi_reg_v1.h @@ -1177,11 +1177,6 @@ #define GSI_EE_n_CNTXT_SCRATCH_0_SCRATCH_BMSK 0xffffffff #define GSI_EE_n_CNTXT_SCRATCH_0_SCRATCH_SHFT 0x0 -#define GSI_EE_n_CNTXT_SCRATCH_1_OFFS(n) \ - (GSI_GSI_REG_BASE_OFFS + 0x0001f404 + 0x4000 * (n)) -#define GSI_EE_n_CNTXT_SCRATCH_1_SCRATCH_BMSK 0xffffffff -#define GSI_EE_n_CNTXT_SCRATCH_1_SCRATCH_SHFT 0x0 - #define GSI_INTER_EE_n_SRC_GSI_CH_IRQ_OFFS(n) \ (GSI_GSI_REG_BASE_OFFS + 0x0000c018 + 0x1000 * (n)) #define GSI_INTER_EE_n_SRC_GSI_CH_IRQ_GSI_CH_BIT_MAP_BMSK 0xffffffff diff --git a/drivers/platform/msm/gsi/gsi_reg_v2.h b/drivers/platform/msm/gsi/gsi_reg_v2.h index 11ce1c435969..459c0ba7c42f 100644 --- a/drivers/platform/msm/gsi/gsi_reg_v2.h +++ b/drivers/platform/msm/gsi/gsi_reg_v2.h @@ -1180,11 +1180,6 @@ #define GSI_EE_n_CNTXT_SCRATCH_0_SCRATCH_BMSK 0xffffffff #define GSI_EE_n_CNTXT_SCRATCH_0_SCRATCH_SHFT 0x0 -#define GSI_EE_n_CNTXT_SCRATCH_1_OFFS(n) \ - (GSI_GSI_REG_BASE_OFFS + 0x00012404 + 0x4000 * (n)) -#define GSI_EE_n_CNTXT_SCRATCH_1_SCRATCH_BMSK 0xffffffff -#define GSI_EE_n_CNTXT_SCRATCH_1_SCRATCH_SHFT 0x0 - #define GSI_INTER_EE_n_SRC_GSI_CH_IRQ_OFFS(n) \ (GSI_GSI_REG_BASE_OFFS + 0x0000c018 + 0x1000 * (n)) #define GSI_INTER_EE_n_SRC_GSI_CH_IRQ_GSI_CH_BIT_MAP_BMSK 0xffffffff From 2cdeb1993e11b21380bea3675583beb28bbd4715 Mon Sep 17 00:00:00 2001 From: Armaan Siddiqui Date: Mon, 15 Feb 2021 15:05:51 +0530 Subject: [PATCH 4/7] msm: ipa: fix potential race condition ioctls There are potential race condition ioctls in the IPA driver when it copies the actual arguments from the user-space memory to the IPA-driver. The fix is to add check on the 2nd copy to make sure the same payload size is copied to the pre-allocated kernel memory as during the 1st copy. Change-Id: I3d31cb11a24e969db4fd1728cf6ab1ce983a75e9 Signed-off-by: Armaan Siddiqui --- drivers/platform/msm/ipa/ipa_v3/ipa.c | 142 ++++++++++++++++++++++++++ 1 file changed, 142 insertions(+) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c index 7d6b5802dfb0..1f63f9b26f3e 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c @@ -1005,6 +1005,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1043,6 +1044,24 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_add_rt_rule_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_add_rt_rule_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_add_rt_rule_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1082,6 +1101,8 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1097,6 +1118,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, @@ -1138,6 +1160,24 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_add_rt_rule_ext_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_add_rt_rule_ext_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_add_rt_rule_ext_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1179,6 +1219,8 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1194,6 +1236,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1234,6 +1277,23 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_add_rt_rule_after_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_add_rt_rule_after_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_add_rt_rule_after_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1273,6 +1333,8 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1288,6 +1350,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1328,6 +1391,23 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_mdfy_rt_rule_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_mdfy_rt_rule_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_mdfy_rt_rule_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1367,6 +1447,8 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1382,6 +1464,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1421,6 +1504,23 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_add_flt_rule_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_add_flt_rule_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_add_flt_rule_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1459,6 +1559,8 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1474,6 +1576,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1514,6 +1617,23 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_add_flt_rule_after_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_add_flt_rule_after_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_add_flt_rule_after_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1553,6 +1673,8 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; @@ -1568,6 +1690,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) u32 pyld_sz; u64 uptr = 0; u8 *param = NULL; + u8 *param2 = NULL; u8 *kptr = NULL; if (copy_from_user(header, (const void __user *)arg, @@ -1608,6 +1731,23 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) retval = -EFAULT; goto free_param_kptr; } + + param2 = memdup_user((const void __user *)arg, + sizeof(struct ipa_ioc_mdfy_flt_rule_v2)); + if (IS_ERR(param2)) { + retval = -EFAULT; + goto free_param_kptr; + } + + /* add check in case user-space module compromised */ + if (unlikely(((struct ipa_ioc_mdfy_flt_rule_v2 *)param2)->num_rules + != pre_entry)) { + IPAERR_RL("current %d pre %d\n", + ((struct ipa_ioc_mdfy_flt_rule_v2 *)param2)-> + num_rules, pre_entry); + retval = -EFAULT; + goto free_param_kptr; + } /* alloc kernel pointer with actual payload size */ kptr = kzalloc(pyld_sz, GFP_KERNEL); if (!kptr) { @@ -1647,6 +1787,8 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) free_param_kptr: if (!IS_ERR(param)) kfree(param); + if (!IS_ERR(param2)) + kfree(param2); kfree(kptr); return retval; From 5ed13cc181784db38e0203b6c1dab65035c9f3de Mon Sep 17 00:00:00 2001 From: Ashok Vuyyuru Date: Wed, 4 Aug 2021 01:22:04 +0530 Subject: [PATCH 5/7] msm: ipa3: ODL endpoint configuration for monaco ODL endpoint configuration for monaco target. Change-Id: Ic842430d38287d02d44e15a4ee371bad912494c5 Signed-off-by: Ashok Vuyyuru --- drivers/platform/msm/ipa/ipa_v3/ipa_utils.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c index 4d00cf315deb..787f36ef62ef 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c @@ -2281,6 +2281,12 @@ static const struct ipa_ep_configuration ipa3_ep_mapping IPA_DPS_HPS_SEQ_TYPE_INVALID, QMB_MASTER_SELECT_DDR, { 12, 4, 4, 4, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY} }, + [IPA_4_2][IPA_CLIENT_ODL_DPL_CONS] = { + true, IPA_v4_2_GROUP_UL_DL, + false, + IPA_DPS_HPS_SEQ_TYPE_INVALID, + QMB_MASTER_SELECT_DDR, + { 13, 10, 6, 6, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY} }, [IPA_4_2][IPA_CLIENT_APPS_LAN_CONS] = { true, IPA_v4_2_GROUP_UL_DL, false, @@ -2305,12 +2311,6 @@ static const struct ipa_ep_configuration ipa3_ep_mapping IPA_DPS_HPS_SEQ_TYPE_INVALID, QMB_MASTER_SELECT_DDR, { 10, 2, 6, 6, IPA_EE_Q6, GSI_ESCAPE_BUF_ONLY} }, - [IPA_4_2][IPA_CLIENT_Q6_LTE_WIFI_AGGR_CONS] = { - true, IPA_v4_2_GROUP_UL_DL, - false, - IPA_DPS_HPS_SEQ_TYPE_INVALID, - QMB_MASTER_SELECT_DDR, - { 13, 4, 6, 6, IPA_EE_Q6, GSI_ESCAPE_BUF_ONLY} }, [IPA_4_2][IPA_CLIENT_ETHERNET_CONS] = { true, IPA_v4_2_GROUP_UL_DL, false, From bdbc1bf0a98394981558eec00d6ce48336d353a9 Mon Sep 17 00:00:00 2001 From: Armaan Siddiqui Date: Wed, 12 May 2021 15:07:53 +0530 Subject: [PATCH 6/7] ipa: Fix to match correct values after copying Changes done to copy num of rules from user space to kernel side as earlier only payload was being copied. Change-Id: I14e15fe0c6746226cc44d224d33c00e809cd69ca Signed-off-by: Armaan Siddiqui --- drivers/platform/msm/ipa/ipa_v3/ipa.c | 91 ++++++++++++++------------- 1 file changed, 49 insertions(+), 42 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c index 1f63f9b26f3e..3b02a4192da3 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c @@ -1026,8 +1026,9 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_v2 *) - header)->rule_add_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_v2 ) + + ((struct ipa_ioc_add_rt_rule_v2 *) + header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; uptr = ((struct ipa_ioc_add_rt_rule_v2 *) @@ -1038,7 +1039,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1070,7 +1071,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), - (void *)param + i * + (void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_v2 *) @@ -1085,13 +1086,13 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1141,8 +1142,9 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_ext_v2 *) - header)->rule_add_ext_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_ext_v2 ) + + ((struct ipa_ioc_add_rt_rule_ext_v2 *) + header)->rule_add_ext_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_ext_i) * pre_entry; @@ -1154,7 +1156,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1187,7 +1189,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), - (void *)param + i * + (void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, ((struct ipa_ioc_add_rt_rule_ext_v2 *) @@ -1202,14 +1204,14 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1258,8 +1260,9 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_after_v2 *) - header)->rule_add_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_after_v2) + + ((struct ipa_ioc_add_rt_rule_after_v2 *) + header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; @@ -1271,7 +1274,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1302,7 +1305,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), - (void *)param + i * + (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_after_v2 *) @@ -1317,13 +1320,13 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1372,8 +1375,9 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_mdfy_rt_rule_v2 *) - header)->rule_mdfy_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_rt_rule_v2) + + ((struct ipa_ioc_mdfy_rt_rule_v2 *) + header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_mdfy_i) * pre_entry; @@ -1385,7 +1389,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1416,7 +1420,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), - (void *)param + i * + (void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_rt_rule_v2 *) @@ -1431,13 +1435,13 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1485,8 +1489,9 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_v2 *) - header)->flt_rule_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_v2) + + ((struct ipa_ioc_add_flt_rule_v2 *) + header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) * pre_entry; @@ -1498,7 +1503,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1529,7 +1534,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), - (void *)param + i * + (void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_v2 *) @@ -1544,13 +1549,13 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1598,8 +1603,9 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_after_v2 *) - header)->flt_rule_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_after_v2) + + ((struct ipa_ioc_add_flt_rule_after_v2 *) + header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) * pre_entry; @@ -1611,7 +1617,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1642,7 +1648,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), - (void *)param + i * + (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_after_v2 *) @@ -1657,13 +1663,13 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1712,8 +1718,9 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = ((struct ipa_ioc_mdfy_flt_rule_v2 *) - header)->rule_mdfy_size * pre_entry; + usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_flt_rule_v2) + + ((struct ipa_ioc_mdfy_flt_rule_v2 *) + header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_mdfy_i) * pre_entry; @@ -1725,7 +1732,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)uptr, + param = memdup_user((const void __user *)arg, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1756,7 +1763,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), - (void *)param + i * + (void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_flt_rule_v2 *) @@ -1771,13 +1778,13 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)param + i * + memcpy((void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size); - if (copy_to_user((void __user *)uptr, param, + if (copy_to_user((void __user *)arg, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; From 56b50e9752c4948c790eb5b81eaa18373e70209d Mon Sep 17 00:00:00 2001 From: Goutam Bose Date: Thu, 5 Aug 2021 19:32:42 +0530 Subject: [PATCH 7/7] Revert "ipa: Fix to match correct values after..." This reverts commit bdbc1bf0a98394981558eec00d6ce48336d353a9. --- drivers/platform/msm/ipa/ipa_v3/ipa.c | 91 +++++++++++++-------------- 1 file changed, 42 insertions(+), 49 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c index 3b02a4192da3..1f63f9b26f3e 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c @@ -1026,9 +1026,8 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_v2 ) + - ((struct ipa_ioc_add_rt_rule_v2 *) - header)->rule_add_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_v2 *) + header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; uptr = ((struct ipa_ioc_add_rt_rule_v2 *) @@ -1039,7 +1038,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1071,7 +1070,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), - (void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_v2 *) @@ -1086,13 +1085,13 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1142,9 +1141,8 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_ext_v2 ) + - ((struct ipa_ioc_add_rt_rule_ext_v2 *) - header)->rule_add_ext_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_ext_v2 *) + header)->rule_add_ext_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_ext_i) * pre_entry; @@ -1156,7 +1154,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1189,7 +1187,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), - (void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, ((struct ipa_ioc_add_rt_rule_ext_v2 *) @@ -1204,14 +1202,14 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1260,9 +1258,8 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_after_v2) + - ((struct ipa_ioc_add_rt_rule_after_v2 *) - header)->rule_add_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_after_v2 *) + header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; @@ -1274,7 +1271,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1305,7 +1302,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), - (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_after_v2 *) @@ -1320,13 +1317,13 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1375,9 +1372,8 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_rt_rule_v2) + - ((struct ipa_ioc_mdfy_rt_rule_v2 *) - header)->rule_mdfy_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_mdfy_rt_rule_v2 *) + header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_mdfy_i) * pre_entry; @@ -1389,7 +1385,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1420,7 +1416,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), - (void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_rt_rule_v2 *) @@ -1435,13 +1431,13 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1489,9 +1485,8 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_v2) + - ((struct ipa_ioc_add_flt_rule_v2 *) - header)->flt_rule_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_v2 *) + header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) * pre_entry; @@ -1503,7 +1498,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1534,7 +1529,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), - (void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_v2 *) @@ -1549,13 +1544,13 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1603,9 +1598,8 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_after_v2) + - ((struct ipa_ioc_add_flt_rule_after_v2 *) - header)->flt_rule_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_after_v2 *) + header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) * pre_entry; @@ -1617,7 +1611,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1648,7 +1642,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), - (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_after_v2 *) @@ -1663,13 +1657,13 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; @@ -1718,9 +1712,8 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ - usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_flt_rule_v2) + - ((struct ipa_ioc_mdfy_flt_rule_v2 *) - header)->rule_mdfy_size * pre_entry; + usr_pyld_sz = ((struct ipa_ioc_mdfy_flt_rule_v2 *) + header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_mdfy_i) * pre_entry; @@ -1732,7 +1725,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ - param = memdup_user((const void __user *)arg, + param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; @@ -1763,7 +1756,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), - (void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * + (void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_flt_rule_v2 *) @@ -1778,13 +1771,13 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) - memcpy((void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * + memcpy((void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size); - if (copy_to_user((void __user *)arg, param, + if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT;