Merge "msm: ipa: fix security issues in ipa wan driver" into msm-4.9 (644c6359) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -80,6 +80,7 @@ static void *subsys_notify_handle;

		u32 apps_to_ipa_hdl, ipa_to_apps_hdl; /* get handler from ipa */
		static struct mutex ipa_to_apps_pipe_handle_guard;
		static struct mutex add_mux_channel_lock;
		static int wwan_add_ul_flt_rule_to_ipa(void);
		static int wwan_del_ul_flt_rule_to_ipa(void);
		static void ipa_wwan_msg_free_cb(void*, u32, u32);
		@@ -1527,9 +1528,11 @@ static int ipa_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		rmnet_mux_val.mux_id);
		return rc;
		}
		mutex_lock(&add_mux_channel_lock);
		if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
		IPAWANERR("Exceed mux_channel limit(%d)\n",
		rmnet_index);
		mutex_unlock(&add_mux_channel_lock);
		return -EFAULT;
		}
		IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
		@@ -1558,6 +1561,7 @@ static int ipa_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		IPAWANERR("device %s reg IPA failed\n",
		extend_ioctl_data.u.
		rmnet_mux_val.vchannel_name);
		mutex_unlock(&add_mux_channel_lock);
		return -ENODEV;
		}
		mux_channel[rmnet_index].mux_channel_set = true;
		@@ -1570,6 +1574,7 @@ static int ipa_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		mux_channel[rmnet_index].ul_flt_reg = false;
		}
		rmnet_index++;
		mutex_unlock(&add_mux_channel_lock);
		break;
		case RMNET_IOCTL_SET_EGRESS_DATA_FORMAT:
		IPAWANDBG("get RMNET_IOCTL_SET_EGRESS_DATA_FORMAT\n");
		@@ -3084,6 +3089,7 @@ static int __init ipa_wwan_init(void)
		atomic_set(&is_ssr, 0);

		mutex_init(&ipa_to_apps_pipe_handle_guard);
		mutex_init(&add_mux_channel_lock);
		ipa_to_apps_hdl = -1;

		ipa_qmi_init();
		@@ -3103,6 +3109,7 @@ static void __exit ipa_wwan_cleanup(void)

		ipa_qmi_cleanup();
		mutex_destroy(&ipa_to_apps_pipe_handle_guard);
		mutex_destroy(&add_mux_channel_lock);
		ret = subsys_notif_unregister_notifier(subsys_notify_handle,
		&ssr_notifier);
		if (ret)

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -141,6 +141,7 @@ struct rmnet_ipa3_context {
		u32 apps_to_ipa3_hdl;
		u32 ipa3_to_apps_hdl;
		struct mutex pipe_handle_guard;
		struct mutex add_mux_channel_lock;
		};

		static struct rmnet_ipa3_context *rmnet_ipa3_ctx;
		@@ -1636,10 +1637,13 @@ static int ipa3_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		rmnet_mux_val.mux_id);
		return rc;
		}
		mutex_lock(&rmnet_ipa3_ctx->add_mux_channel_lock);
		if (rmnet_ipa3_ctx->rmnet_index
		>= MAX_NUM_OF_MUX_CHANNEL) {
		IPAWANERR("Exceed mux_channel limit(%d)\n",
		rmnet_ipa3_ctx->rmnet_index);
		mutex_unlock(&rmnet_ipa3_ctx->
		add_mux_channel_lock);
		return -EFAULT;
		}
		IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
		@@ -1673,6 +1677,8 @@ static int ipa3_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		IPAWANERR("device %s reg IPA failed\n",
		extend_ioctl_data.u.
		rmnet_mux_val.vchannel_name);
		mutex_unlock(&rmnet_ipa3_ctx->
		add_mux_channel_lock);
		return -ENODEV;
		}
		mux_channel[rmnet_index].mux_channel_set = true;
		@@ -1685,6 +1691,7 @@ static int ipa3_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		mux_channel[rmnet_index].ul_flt_reg = false;
		}
		rmnet_ipa3_ctx->rmnet_index++;
		mutex_unlock(&rmnet_ipa3_ctx->add_mux_channel_lock);
		break;
		case RMNET_IOCTL_SET_EGRESS_DATA_FORMAT:
		rc = handle3_egress_format(dev, &extend_ioctl_data);
		@@ -3204,6 +3211,7 @@ static int __init ipa3_wwan_init(void)
		atomic_set(&rmnet_ipa3_ctx->is_ssr, 0);

		mutex_init(&rmnet_ipa3_ctx->pipe_handle_guard);
		mutex_init(&rmnet_ipa3_ctx->add_mux_channel_lock);
		rmnet_ipa3_ctx->ipa3_to_apps_hdl = -1;
		rmnet_ipa3_ctx->apps_to_ipa3_hdl = -1;

		@@ -3222,8 +3230,10 @@ static int __init ipa3_wwan_init(void)
		static void __exit ipa3_wwan_cleanup(void)
		{
		int ret;

		ipa3_qmi_cleanup();
		mutex_destroy(&rmnet_ipa3_ctx->pipe_handle_guard);
		mutex_destroy(&rmnet_ipa3_ctx->add_mux_channel_lock);
		ret = subsys_notif_unregister_notifier(
		rmnet_ipa3_ctx->subsys_notify_handle, &ipa3_ssr_notifier);
		if (ret)