Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cbe2994 authored by Mohammed Javid's avatar Mohammed Javid
Browse files

msm: ipa: Fix to unsigned integer underflow 



Added code changes to fix the unsigned integer underflow
leads to accessing unmapped memory.

Change-Id: I8148aebd3597ec6ae8c184199afe816f3d80636e
Acked-by: default avatarAshok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent 8cf0b1c9

drivers/platform/msm/ipa/ipa_v2/ipa_debugfs.c

+10 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1455,6 +1455,10 @@ static ssize_t ipa_read_nat4(struct file *file, 
	pr_err("Table Size:%d\n",

				ipa_ctx->nat_mem.size_base_tables);



	if (!ipa_ctx->nat_mem.size_expansion_tables)

		pr_err("Expansion Table Size:%d\n",

				ipa_ctx->nat_mem.size_expansion_tables);

	else

		pr_err("Expansion Table Size:%d\n",

				ipa_ctx->nat_mem.size_expansion_tables-1);
@@ -1470,6 +1474,8 @@ static ssize_t ipa_read_nat4(struct file *file, 


			pr_err("\nBase Table:\n");

		} else {

			if (!ipa_ctx->nat_mem.size_expansion_tables)

				continue;

			tbl_size = ipa_ctx->nat_mem.size_expansion_tables-1;

			base_tbl =

			 (u32 *)ipa_ctx->nat_mem.ipv4_expansion_rules_addr;
@@ -1569,6 +1575,8 @@ static ssize_t ipa_read_nat4(struct file *file, 


			pr_err("\nIndex Table:\n");

		} else {

			if (!ipa_ctx->nat_mem.size_expansion_tables)

				continue;

			tbl_size = ipa_ctx->nat_mem.size_expansion_tables-1;

			indx_tbl =

			 (u32 *)ipa_ctx->nat_mem.index_table_expansion_addr;