Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 650520bd authored by Rishabh Garg's avatar Rishabh Garg
Browse files

msm:ipa3 dereferencing Null pointer and casting error fixes 



Resolved Null pointer dereferencing by adding check
on NULL pointer.
Resolved casting error by skipping the casting.

Added some header file to resolve implicit function
decation issue.

Change-Id: I69971e4e693adfaf6d5d3c2e5b9d9a6f4e18cf10
Signed-off-by: default avatarRishabh Garg <rishgarg@codeaurora.org>
parent 55b538bc

drivers/platform/msm/ipa/ipa_common_i.h

+2 −0
Original line number Diff line number Diff line
@@ -21,6 +21,8 @@ 
#include <linux/ipa_uc_offload.h>

#include <linux/ipa_wdi3.h>

#include <linux/ratelimit.h>

#include <linux/swab.h>

#include <linux/compiler.h>



#define WARNON_RATELIMIT_BURST 1

#define IPA_RATELIMIT_BURST 1

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+16 −10
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1590,7 +1590,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
				(RMNET_IOCTL_FEAT_NOTIFY_MUX_CHANNEL |

				RMNET_IOCTL_FEAT_SET_EGRESS_DATA_FORMAT |

				RMNET_IOCTL_FEAT_SET_INGRESS_DATA_FORMAT);

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

			if (copy_to_user(ifr->ifr_ifru.ifru_data,

				&extend_ioctl_data,

				sizeof(struct rmnet_ioctl_extended_s)))

				rc = -EFAULT;
@@ -1604,7 +1604,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
		/*  Get MRU  */

		case RMNET_IOCTL_GET_MRU:

			extend_ioctl_data.u.data = mru;

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

			if (copy_to_user(ifr->ifr_ifru.ifru_data,

				&extend_ioctl_data,

				sizeof(struct rmnet_ioctl_extended_s)))

				rc = -EFAULT;
@@ -1613,7 +1613,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
		case RMNET_IOCTL_GET_SG_SUPPORT:

			extend_ioctl_data.u.data =

				ipa3_rmnet_res.ipa_advertise_sg_support;

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

			if (copy_to_user(ifr->ifr_ifru.ifru_data,

				&extend_ioctl_data,

				sizeof(struct rmnet_ioctl_extended_s)))

				rc = -EFAULT;
@@ -1622,7 +1622,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
		case RMNET_IOCTL_GET_EPID:

			IPAWANDBG("get ioctl: RMNET_IOCTL_GET_EPID\n");

			extend_ioctl_data.u.data = epid;

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

			if (copy_to_user(ifr->ifr_ifru.ifru_data,

				&extend_ioctl_data,

				sizeof(struct rmnet_ioctl_extended_s)))

				rc = -EFAULT;
@@ -1643,7 +1643,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
			ipa3_get_ep_mapping(IPA_CLIENT_APPS_WAN_PROD);

			extend_ioctl_data.u.ipa_ep_pair.producer_pipe_num =

			ipa3_get_ep_mapping(IPA_CLIENT_APPS_WAN_CONS);

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

			if (copy_to_user(ifr->ifr_ifru.ifru_data,

				&extend_ioctl_data,

				sizeof(struct rmnet_ioctl_extended_s)))

				rc = -EFAULT;
@@ -1660,13 +1660,19 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
			break;

		/*  Get driver name  */

		case RMNET_IOCTL_GET_DRIVER_NAME:

			if (IPA_NETDEV() != NULL) {

				memcpy(&extend_ioctl_data.u.if_name,

					IPA_NETDEV()->name, IFNAMSIZ);

			extend_ioctl_data.u.if_name[IFNAMSIZ - 1] = '\0';

			if (copy_to_user((u8 *)ifr->ifr_ifru.ifru_data,

				extend_ioctl_data.u.if_name[IFNAMSIZ - 1] =

				'\0';

				if (copy_to_user(ifr->ifr_ifru.ifru_data,

					&extend_ioctl_data,

					sizeof(struct rmnet_ioctl_extended_s)))

					rc = -EFAULT;

			} else {

				IPAWANERR("IPA_NETDEV is NULL\n");

				rc = -EFAULT;

			}

			break;

		/*  Add MUX ID  */

		case RMNET_IOCTL_ADD_MUX_CHANNEL: