A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: ipa3: Add check to validate rule_cnt

Browse source 
Add proper check to validate table rule count
which may lead to overflow error.

Change-Id: I9bdcafcaae4e4cff1b901929c8dc6ae804f85642
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
This commit is contained in:
Praveen Kurapati 2020-11-23 14:09:07 +05:30
commit fd57264b26
3 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
drivers/platform/msm/ipa/ipa_v3/ipa_flt.c
View file

@ -947,7 +947,10 @@ static int __ipa_finish_flt_rule_add(struct ipa3_flt_tbl *tbl,
{
int id;
tbl->rule_cnt++;
if (tbl->rule_cnt < IPA_RULE_CNT_MAX)
tbl->rule_cnt++;
else
return -EINVAL;
if (entry->rt_tbl)
entry->rt_tbl->ref_cnt++;
id = ipa3_id_alloc(entry);

2
drivers/platform/msm/ipa/ipa_v3/ipa_i.h
View file

@ -454,6 +454,8 @@ enum {
#define MBOX_TOUT_MS 100
#define IPA_RULE_CNT_MAX 512
/* miscellaneous for rmnet_ipa and qmi_service */
enum ipa_type_mode {
IPA_HW_TYPE,

5
drivers/platform/msm/ipa/ipa_v3/ipa_rt.c
View file

@ -1080,7 +1080,10 @@ static int __ipa_finish_rt_rule_add(struct ipa3_rt_entry *entry, u32 *rule_hdl,
{
int id;
tbl->rule_cnt++;
if (tbl->rule_cnt < IPA_RULE_CNT_MAX)
tbl->rule_cnt++;
else
return -EINVAL;
if (entry->hdr)
entry->hdr->ref_cnt++;
else if (entry->proc_ctx)