A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 05:39:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa3: Fix to avoid memory out of bound access error

Browse source 
Allocate the memory of structure size instead of using macros
generated by IDL.

Change-Id: I400506e0a7228e71d8c76fd39723d88ce29e3016
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
This commit is contained in:
Praveen Kurapati 2019-11-27 18:44:17 +05:30
commit d85b4e856c
1 changed files with 17 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

36
drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c
View file

@ -1614,63 +1614,61 @@ static struct qmi_msg_handler server_handlers[] = {
.type = QMI_REQUEST,
.msg_id = QMI_IPA_INDICATION_REGISTER_REQ_V01,
.ei = ipa3_indication_reg_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_INDICATION_REGISTER_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(struct ipa_indication_reg_req_msg_v01),
.fn = ipa3_handle_indication_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_INSTALL_FILTER_RULE_REQ_V01,
.ei = ipa3_install_fltr_rule_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_INSTALL_FILTER_RULE_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_install_fltr_rule_req_msg_v01),
.fn = ipa3_handle_install_filter_rule_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_FILTER_INSTALLED_NOTIF_REQ_V01,
.ei = ipa3_fltr_installed_notif_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_FILTER_INSTALLED_NOTIF_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_fltr_installed_notif_req_msg_v01),
.fn = ipa3_handle_filter_installed_notify_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_CONFIG_REQ_V01,
.ei = ipa3_config_req_msg_data_v01_ei,
.decoded_size = QMI_IPA_CONFIG_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(struct ipa_config_req_msg_v01),
.fn = handle_ipa_config_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_V01,
.ei = ipa3_init_modem_driver_cmplt_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_init_modem_driver_cmplt_req_msg_v01),
.fn = ipa3_handle_modem_init_cmplt_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_V01,
.ei = ipa3_init_modem_driver_cmplt_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_init_modem_driver_cmplt_req_msg_v01),
.fn = ipa3_handle_modem_init_cmplt_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_MHI_ALLOC_CHANNEL_REQ_V01,
.ei = ipa_mhi_alloc_channel_req_msg_v01_ei,
.decoded_size =
IPA_MHI_ALLOC_CHANNEL_REQ_MSG_V01_MAX_MSG_LEN,
.decoded_size = sizeof(
struct ipa_mhi_alloc_channel_req_msg_v01),
.fn = ipa3_handle_mhi_alloc_channel_req,
},
{
.type = QMI_REQUEST,
.msg_id = QMI_IPA_MHI_CLK_VOTE_REQ_V01,
.ei = ipa_mhi_clk_vote_req_msg_v01_ei,
.decoded_size =
IPA_MHI_CLK_VOTE_REQ_MSG_V01_MAX_MSG_LEN,
.decoded_size = sizeof(struct ipa_mhi_clk_vote_req_msg_v01),
.fn = ipa3_handle_mhi_vote_req,
},
@ -1687,16 +1685,16 @@ static struct qmi_msg_handler client_handlers[] = {
.type = QMI_INDICATION,
.msg_id = QMI_IPA_DATA_USAGE_QUOTA_REACHED_IND_V01,
.ei = ipa3_data_usage_quota_reached_ind_msg_data_v01_ei,
.decoded_size =
QMI_IPA_DATA_USAGE_QUOTA_REACHED_IND_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_data_usage_quota_reached_ind_msg_v01),
.fn = ipa3_q6_clnt_quota_reached_ind_cb,
},
{
.type = QMI_INDICATION,
.msg_id = QMI_IPA_INSTALL_UL_FIREWALL_RULES_IND_V01,
.ei = ipa3_install_fltr_rule_req_msg_data_v01_ei,
.decoded_size =
QMI_IPA_INSTALL_UL_FIREWALL_RULES_IND_MAX_MSG_LEN_V01,
.decoded_size = sizeof(
struct ipa_configure_ul_firewall_rules_ind_msg_v01),
.fn = ipa3_q6_clnt_install_firewall_rules_ind_cb,
},
};