diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_hw_stats.c b/drivers/platform/msm/ipa/ipa_v3/ipa_hw_stats.c index 3ae0f9976cf8..aa7c3afa8c1c 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_hw_stats.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_hw_stats.c @@ -2311,7 +2311,7 @@ static ssize_t ipa_debugfs_enable_disable_drop_stats(struct file *file, is_pipe = true; } if (dbg_buff[i] == seprator) { - if (pipe_num >= 0 && pipe_num < ipa3_ctx->ipa_num_pipes + if (pipe_num < ipa3_ctx->ipa_num_pipes && ipa3_get_client_by_pipe(pipe_num) < IPA_CLIENT_MAX) { IPADBG("pipe number %u\n", pipe_num); @@ -2326,7 +2326,7 @@ static ssize_t ipa_debugfs_enable_disable_drop_stats(struct file *file, is_pipe = false; } } - if (is_pipe && pipe_num >= 0 && pipe_num < ipa3_ctx->ipa_num_pipes && + if (is_pipe && pipe_num < ipa3_ctx->ipa_num_pipes && ipa3_get_client_by_pipe(pipe_num) < IPA_CLIENT_MAX) { IPADBG("pipe number %u\n", pipe_num); if (enable_pipe) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c b/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c index 49417831e1a8..980bdc1f5aa7 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_intf.c @@ -82,19 +82,19 @@ int ipa3_register_intf_ext(const char *name, const struct ipa_tx_intf *tx, return -EINVAL; } - if (tx && tx->num_props > IPA_NUM_PROPS_MAX) { + if (tx && ((tx->num_props > IPA_NUM_PROPS_MAX) || (tx->num_props == 0))) { IPAERR_RL("invalid tx num_props=%d max=%d\n", tx->num_props, IPA_NUM_PROPS_MAX); return -EINVAL; } - if (rx && rx->num_props > IPA_NUM_PROPS_MAX) { + if (rx && ((rx->num_props > IPA_NUM_PROPS_MAX) || (rx->num_props == 0))) { IPAERR_RL("invalid rx num_props=%d max=%d\n", rx->num_props, IPA_NUM_PROPS_MAX); return -EINVAL; } - if (ext && ext->num_props > IPA_NUM_PROPS_MAX) { + if (ext && ((ext->num_props > IPA_NUM_PROPS_MAX) || (ext->num_props == 0))) { IPAERR_RL("invalid ext num_props=%d max=%d\n", ext->num_props, IPA_NUM_PROPS_MAX); return -EINVAL; diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c index 41544e22d2e9..28cfaf4bcfd5 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c @@ -897,11 +897,7 @@ int ipa3_qmi_add_offload_request_send( return -EINVAL; } - /* check if the filter rules from IPACM is valid */ - if (req->filter_spec_ex2_list_len < 0) { - IPAWANERR("IPACM pass invalid num of rules\n"); - return -EINVAL; - } else if (req->filter_spec_ex2_list_len == 0) { + if (req->filter_spec_ex2_list_len == 0) { IPAWANDBG("IPACM pass zero rules to Q6\n"); } else { IPAWANDBG("IPACM pass %u rules to Q6\n", diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c index 8c21090ffdab..79166258abae 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c @@ -1083,7 +1083,7 @@ static int __ipa_finish_rt_rule_add(struct ipa3_rt_entry *entry, u32 *rule_hdl, if (tbl->rule_cnt < IPA_RULE_CNT_MAX) tbl->rule_cnt++; else - return -EINVAL; + goto table_insert_failed; if (entry->hdr) entry->hdr->ref_cnt++; else if (entry->proc_ctx) @@ -1107,6 +1107,7 @@ ipa_insert_failed: else if (entry->proc_ctx) entry->proc_ctx->ref_cnt--; idr_remove(tbl->rule_ids, entry->rule_id); +table_insert_failed: list_del(&entry->link); kmem_cache_free(ipa3_ctx->rt_rule_cache, entry); return -EPERM; diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 96623321bbe5..6d47eac263a0 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -3410,8 +3410,7 @@ int rmnet_ipa3_set_tether_client_pipe( return -EFAULT; } /* error checking if dl_dst_pipe_len valid or not*/ - if (data->dl_dst_pipe_len > QMI_IPA_MAX_PIPES_V01 || - data->dl_dst_pipe_len < 0) { + if (data->dl_dst_pipe_len > QMI_IPA_MAX_PIPES_V01) { IPAWANERR("DL dst pipes %d exceeding max %d\n", data->dl_dst_pipe_len, QMI_IPA_MAX_PIPES_V01);