From d85b4e856c11ef0d0791971135cdb5eb09828298 Mon Sep 17 00:00:00 2001 From: Praveen Kurapati Date: Wed, 27 Nov 2019 18:44:17 +0530 Subject: [PATCH] msm: ipa3: Fix to avoid memory out of bound access error Allocate the memory of structure size instead of using macros generated by IDL. Change-Id: I400506e0a7228e71d8c76fd39723d88ce29e3016 Signed-off-by: Praveen Kurapati --- .../platform/msm/ipa/ipa_v3/ipa_qmi_service.c | 36 +++++++++---------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c index 83ffe04ceaf4..a72a5b60fdaa 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c @@ -1614,63 +1614,61 @@ static struct qmi_msg_handler server_handlers[] = { .type = QMI_REQUEST, .msg_id = QMI_IPA_INDICATION_REGISTER_REQ_V01, .ei = ipa3_indication_reg_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_INDICATION_REGISTER_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof(struct ipa_indication_reg_req_msg_v01), .fn = ipa3_handle_indication_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_INSTALL_FILTER_RULE_REQ_V01, .ei = ipa3_install_fltr_rule_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_INSTALL_FILTER_RULE_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_install_fltr_rule_req_msg_v01), .fn = ipa3_handle_install_filter_rule_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_FILTER_INSTALLED_NOTIF_REQ_V01, .ei = ipa3_fltr_installed_notif_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_FILTER_INSTALLED_NOTIF_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_fltr_installed_notif_req_msg_v01), .fn = ipa3_handle_filter_installed_notify_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_CONFIG_REQ_V01, .ei = ipa3_config_req_msg_data_v01_ei, - .decoded_size = QMI_IPA_CONFIG_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof(struct ipa_config_req_msg_v01), .fn = handle_ipa_config_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_V01, .ei = ipa3_init_modem_driver_cmplt_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_init_modem_driver_cmplt_req_msg_v01), .fn = ipa3_handle_modem_init_cmplt_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_V01, .ei = ipa3_init_modem_driver_cmplt_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_INIT_MODEM_DRIVER_CMPLT_REQ_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_init_modem_driver_cmplt_req_msg_v01), .fn = ipa3_handle_modem_init_cmplt_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_MHI_ALLOC_CHANNEL_REQ_V01, .ei = ipa_mhi_alloc_channel_req_msg_v01_ei, - .decoded_size = - IPA_MHI_ALLOC_CHANNEL_REQ_MSG_V01_MAX_MSG_LEN, + .decoded_size = sizeof( + struct ipa_mhi_alloc_channel_req_msg_v01), .fn = ipa3_handle_mhi_alloc_channel_req, }, { .type = QMI_REQUEST, .msg_id = QMI_IPA_MHI_CLK_VOTE_REQ_V01, .ei = ipa_mhi_clk_vote_req_msg_v01_ei, - .decoded_size = - IPA_MHI_CLK_VOTE_REQ_MSG_V01_MAX_MSG_LEN, + .decoded_size = sizeof(struct ipa_mhi_clk_vote_req_msg_v01), .fn = ipa3_handle_mhi_vote_req, }, @@ -1687,16 +1685,16 @@ static struct qmi_msg_handler client_handlers[] = { .type = QMI_INDICATION, .msg_id = QMI_IPA_DATA_USAGE_QUOTA_REACHED_IND_V01, .ei = ipa3_data_usage_quota_reached_ind_msg_data_v01_ei, - .decoded_size = - QMI_IPA_DATA_USAGE_QUOTA_REACHED_IND_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_data_usage_quota_reached_ind_msg_v01), .fn = ipa3_q6_clnt_quota_reached_ind_cb, }, { .type = QMI_INDICATION, .msg_id = QMI_IPA_INSTALL_UL_FIREWALL_RULES_IND_V01, .ei = ipa3_install_fltr_rule_req_msg_data_v01_ei, - .decoded_size = - QMI_IPA_INSTALL_UL_FIREWALL_RULES_IND_MAX_MSG_LEN_V01, + .decoded_size = sizeof( + struct ipa_configure_ul_firewall_rules_ind_msg_v01), .fn = ipa3_q6_clnt_install_firewall_rules_ind_cb, }, };