Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1165b0f0 authored by Mohammed Javid's avatar Mohammed Javid Committed by Gerrit - the friendly Code Review server
Browse files

msm:ipa:Prevent rt rule deletion if rt rule id is invalid 



Currently RT is deleted even if rt rule or header proc ctx
is invalid. Add check to prevent it.

Change-Id: Ic37ff9a33fab2b3c0d6393e43452e4b62a91d932
Acked-by: default avatarPooja Kumari <kumarip@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent 845f1f2e

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+23 −0
Original line number Original line Diff line number Diff line
@@ -1344,6 +1344,8 @@ int ipa2_reset_rt(enum ipa_ip_type ip, bool user_only) 
	struct ipa_rt_entry *rule_next;

	struct ipa_rt_entry *rule_next;

	struct ipa_rt_tbl_set *rset;

	struct ipa_rt_tbl_set *rset;

	u32 apps_start_idx;

	u32 apps_start_idx;

	struct ipa_hdr_entry *hdr_entry;

	struct ipa_hdr_proc_ctx_entry *hdr_proc_entry;

	int id;

	int id;

	bool tbl_user = false;

	bool tbl_user = false;
@@ -1397,6 +1399,27 @@ int ipa2_reset_rt(enum ipa_ip_type ip, bool user_only) 
			if (!user_only ||

			if (!user_only ||

				rule->ipacm_installed) {

				rule->ipacm_installed) {

				list_del(&rule->link);

				list_del(&rule->link);

				if (rule->hdr) {

					hdr_entry = ipa_id_find(

						rule->rule.hdr_hdl);

					if (!hdr_entry ||

					hdr_entry->cookie != IPA_HDR_COOKIE) {

						IPAERR_RL(

						"Header already deleted\n");

						return -EINVAL;

					}

				} else if (rule->proc_ctx) {

					hdr_proc_entry =

						ipa_id_find(

						rule->rule.hdr_proc_ctx_hdl);

					if (!hdr_proc_entry ||

						hdr_proc_entry->cookie !=

						IPA_PROC_HDR_COOKIE) {

					IPAERR_RL(

						"Proc entry already deleted\n");

						return -EINVAL;

					}

				}

				tbl->rule_cnt--;

				tbl->rule_cnt--;

				if (rule->hdr)

				if (rule->hdr)

					__ipa_release_hdr(rule->hdr->id);

					__ipa_release_hdr(rule->hdr->id);

drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+26 −1
Original line number Original line Diff line number Diff line
@@ -1487,6 +1487,8 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
	struct ipa3_rt_entry *rule;

	struct ipa3_rt_entry *rule;

	struct ipa3_rt_entry *rule_next;

	struct ipa3_rt_entry *rule_next;

	struct ipa3_rt_tbl_set *rset;

	struct ipa3_rt_tbl_set *rset;

	struct ipa3_hdr_entry *hdr_entry;

	struct ipa3_hdr_proc_ctx_entry *hdr_proc_entry;

	u32 apps_start_idx;

	u32 apps_start_idx;

	int id;

	int id;

	bool tbl_user = false;

	bool tbl_user = false;
@@ -1540,6 +1542,27 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
			if (!user_only ||

			if (!user_only ||

				rule->ipacm_installed) {

				rule->ipacm_installed) {

				list_del(&rule->link);

				list_del(&rule->link);

				if (rule->hdr) {

					hdr_entry = ipa3_id_find(

							rule->rule.hdr_hdl);

					if (!hdr_entry ||

					hdr_entry->cookie != IPA_HDR_COOKIE) {

						IPAERR_RL(

						"Header already deleted\n");

						return -EINVAL;

					}

				} else if (rule->proc_ctx) {

					hdr_proc_entry =

						ipa3_id_find(

						rule->rule.hdr_proc_ctx_hdl);

					if (!hdr_proc_entry ||

						hdr_proc_entry->cookie !=

							IPA_PROC_HDR_COOKIE) {

						IPAERR_RL(

						"Proc entry already deleted\n");

						return -EINVAL;

					}

				}

				tbl->rule_cnt--;

				tbl->rule_cnt--;

				if (rule->hdr)

				if (rule->hdr)

					__ipa3_release_hdr(rule->hdr->id);

					__ipa3_release_hdr(rule->hdr->id);
@@ -1547,7 +1570,9 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
					__ipa3_release_hdr_proc_ctx(

					__ipa3_release_hdr_proc_ctx(

						rule->proc_ctx->id);

						rule->proc_ctx->id);

				rule->cookie = 0;

				rule->cookie = 0;

				idr_remove(tbl->rule_ids, rule->rule_id);

				if (!rule->rule_id_valid)

					idr_remove(tbl->rule_ids,

						rule->rule_id);

				id = rule->id;

				id = rule->id;

				kmem_cache_free(ipa3_ctx->rt_rule_cache, rule);

				kmem_cache_free(ipa3_ctx->rt_rule_cache, rule);