A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa4: Fix to overcome KW issues

Browse source 
Correct the validation of number of dma entries in DMA table
to overcome the out-of-bounds access to dma buffers array.
And make changes to initialize an uninitialized variable
which may contain junk data.

Change-Id: Ia05082c887548e58831ab7dfae42cba97ec13fec
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
This commit is contained in:
Praveen Kurapati 2019-10-24 20:08:31 +05:30 • committed by Gerrit - the friendly Code Review server
commit f3f8ee6701
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/platform/msm/ipa/ipa_v3/ipa_nat.c
View file

@ -1365,14 +1365,24 @@ int ipa3_table_dma_cmd(struct ipa_ioc_nat_dma_cmd *dma)
int i;
struct ipahal_reg_valmask valmask;
struct ipahal_imm_cmd_register_write reg_write_coal_close;
int max_dma_table_cmds = IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC;
IPADBG("\n");
memset(desc, 0, sizeof(desc));
memset(cmd_pyld, 0, sizeof(cmd_pyld));
/**
* We use a descriptor for closing coalsceing endpoint
* by immediate command. So, DMA entries should be less than
* IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC - 1 to overcome
* buffer overflow of ipa3_desc array.
*/
if (ipa3_get_ep_mapping(IPA_CLIENT_APPS_WAN_COAL_CONS) != -1)
max_dma_table_cmds -= 1;
if (!dma->entries ||
dma->entries >= IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC) {
dma->entries > (max_dma_table_cmds - 1)) {
IPAERR_RL("Invalid number of entries %d\n",
dma->entries);
result = -EPERM;

2
drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
View file

@ -6623,7 +6623,7 @@ int ipa3_tag_process(struct ipa3_desc desc[],
struct ipahal_imm_cmd_ip_packet_tag_status status;
int i;
struct sk_buff *dummy_skb;
int res;
int res = 0;
struct ipa3_tag_completion *comp;
int ep_idx;
u32 retry_cnt = 0;