From fd57264b262d2ce652096b029566499d0079da2d Mon Sep 17 00:00:00 2001 From: Praveen Kurapati Date: Mon, 23 Nov 2020 14:09:07 +0530 Subject: [PATCH] msm: ipa3: Add check to validate rule_cnt Add proper check to validate table rule count which may lead to overflow error. Change-Id: I9bdcafcaae4e4cff1b901929c8dc6ae804f85642 Signed-off-by: Praveen Kurapati --- drivers/platform/msm/ipa/ipa_v3/ipa_flt.c | 5 ++++- drivers/platform/msm/ipa/ipa_v3/ipa_i.h | 2 ++ drivers/platform/msm/ipa/ipa_v3/ipa_rt.c | 5 ++++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c index d294bac51a79..4aeab4968f2a 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_flt.c @@ -947,7 +947,10 @@ static int __ipa_finish_flt_rule_add(struct ipa3_flt_tbl *tbl, { int id; - tbl->rule_cnt++; + if (tbl->rule_cnt < IPA_RULE_CNT_MAX) + tbl->rule_cnt++; + else + return -EINVAL; if (entry->rt_tbl) entry->rt_tbl->ref_cnt++; id = ipa3_id_alloc(entry); diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h index 17ca594be236..19b4ac83b70a 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h @@ -454,6 +454,8 @@ enum { #define MBOX_TOUT_MS 100 +#define IPA_RULE_CNT_MAX 512 + /* miscellaneous for rmnet_ipa and qmi_service */ enum ipa_type_mode { IPA_HW_TYPE, diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c index c39678af1af2..81a4573b68f2 100644 --- a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c +++ b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c @@ -1080,7 +1080,10 @@ static int __ipa_finish_rt_rule_add(struct ipa3_rt_entry *entry, u32 *rule_hdl, { int id; - tbl->rule_cnt++; + if (tbl->rule_cnt < IPA_RULE_CNT_MAX) + tbl->rule_cnt++; + else + return -EINVAL; if (entry->hdr) entry->hdr->ref_cnt++; else if (entry->proc_ctx)