Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75fe59c8 authored by Michael Adisumarta's avatar Michael Adisumarta Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: Fix deleting the routing entries 



Make changes to delete the route entry even when the hdr/proc_ctx
handles are already freed. Otherwise the entry will be dangling.

Change-Id: Icbab6b96fa137c5214b37ea33c6203c5a54273ac
Signed-off-by: default avatarAshok Vuyyuru <avuyyuru@codeaurora.org>
Signed-off-by: default avatarMichael Adisumarta <madisuma@codeaurora.org>
parent 93c3a352

drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+21 −29
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -79,14 +79,16 @@ static int ipa_generate_rt_hw_rule(enum ipa_ip_type ip, 


	if (entry->hdr) {

		hdr_entry = ipa3_id_find(entry->rule.hdr_hdl);

		if (!hdr_entry || hdr_entry->cookie != IPA_HDR_COOKIE) {

		if (!hdr_entry || (hdr_entry->cookie != IPA_HDR_COOKIE) ||

			ipa3_check_idr_if_freed(entry->hdr)) {

			IPAERR_RL("Header entry already deleted\n");

			return -EPERM;

		}

	} else if (entry->proc_ctx) {

		hdr_proc_entry = ipa3_id_find(entry->rule.hdr_proc_ctx_hdl);

		if (!hdr_proc_entry ||

			hdr_proc_entry->cookie != IPA_PROC_HDR_COOKIE) {

			(hdr_proc_entry->cookie != IPA_PROC_HDR_COOKIE) ||

			ipa3_check_idr_if_freed(entry->proc_ctx)) {

			IPAERR_RL("Proc header entry already deleted\n");

			return -EPERM;

		}
@@ -1356,18 +1358,19 @@ int __ipa3_del_rt_rule(u32 rule_hdl) 
		hdr_entry = ipa3_id_find(entry->rule.hdr_hdl);

		if (!hdr_entry || hdr_entry->cookie != IPA_HDR_COOKIE) {

			IPAERR_RL("Header entry already deleted\n");

			return -EINVAL;

			entry->hdr = NULL;

		}

	} else if (entry->proc_ctx) {

		hdr_proc_entry = ipa3_id_find(entry->rule.hdr_proc_ctx_hdl);

		if (!hdr_proc_entry ||

			hdr_proc_entry->cookie != IPA_PROC_HDR_COOKIE) {

			IPAERR_RL("Proc header entry already deleted\n");

			return -EINVAL;

			entry->proc_ctx = NULL;

		}

	}



	if (entry->hdr)

	if (entry->hdr &&

		(!ipa3_check_idr_if_freed(entry->hdr)))

		__ipa3_release_hdr(entry->hdr->id);

	else if (entry->proc_ctx &&

		(!ipa3_check_idr_if_freed(entry->proc_ctx)))
@@ -1544,7 +1547,6 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 


			if (!user_only ||

				rule->ipacm_installed) {

				list_del(&rule->link);

				if (rule->hdr) {

					hdr_entry = ipa3_id_find(

							rule->rule.hdr_hdl);
@@ -1552,8 +1554,7 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
					hdr_entry->cookie != IPA_HDR_COOKIE) {

						IPAERR_RL(

						"Header already deleted\n");

						mutex_unlock(&ipa3_ctx->lock);

						return -EINVAL;

						rule->hdr = NULL;

					}

				} else if (rule->proc_ctx) {

					hdr_proc_entry =
@@ -1564,12 +1565,13 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
							IPA_PROC_HDR_COOKIE) {

						IPAERR_RL(

						"Proc entry already deleted\n");

						mutex_unlock(&ipa3_ctx->lock);

						return -EINVAL;

						rule->proc_ctx = NULL;

					}

				}

				tbl->rule_cnt--;

				if (rule->hdr)

				list_del(&rule->link);

				if (rule->hdr &&

					(!ipa3_check_idr_if_freed(rule->hdr)))

					__ipa3_release_hdr(rule->hdr->id);

				else if (rule->proc_ctx &&

					(!ipa3_check_idr_if_freed(
@@ -1746,20 +1748,8 @@ static int __ipa_mdfy_rt_rule(struct ipa_rt_rule_mdfy *rtrule) 
	struct ipa3_hdr_entry *hdr_entry;

	struct ipa3_hdr_proc_ctx_entry *hdr_proc_entry;



	if (rtrule->rule.hdr_hdl) {

		hdr = ipa3_id_find(rtrule->rule.hdr_hdl);

		if ((hdr == NULL) || (hdr->cookie != IPA_HDR_COOKIE)) {

			IPAERR_RL("rt rule does not point to valid hdr\n");

	if (__ipa_rt_validate_hndls(&rtrule->rule, &hdr, &proc_ctx))

		goto error;

		}

	} else if (rtrule->rule.hdr_proc_ctx_hdl) {

		proc_ctx = ipa3_id_find(rtrule->rule.hdr_proc_ctx_hdl);

		if ((proc_ctx == NULL) ||

			(proc_ctx->cookie != IPA_PROC_HDR_COOKIE)) {

			IPAERR_RL("rt rule does not point to valid proc ctx\n");

			goto error;

		}

	}



	entry = ipa3_id_find(rtrule->rt_rule_hdl);

	if (entry == NULL) {
@@ -1782,14 +1772,16 @@ static int __ipa_mdfy_rt_rule(struct ipa_rt_rule_mdfy *rtrule) 


	if (entry->hdr) {

		hdr_entry = ipa3_id_find(entry->rule.hdr_hdl);

		if (!hdr_entry || hdr_entry->cookie != IPA_HDR_COOKIE) {

		if (!hdr_entry || (hdr_entry->cookie != IPA_HDR_COOKIE) ||

			ipa3_check_idr_if_freed(entry->hdr)) {

			IPAERR_RL("Header entry already deleted\n");

			return -EPERM;

		}

	} else if (entry->proc_ctx) {

		hdr_proc_entry = ipa3_id_find(entry->rule.hdr_proc_ctx_hdl);

		if (!hdr_proc_entry ||

			hdr_proc_entry->cookie != IPA_PROC_HDR_COOKIE) {

			(hdr_proc_entry->cookie != IPA_PROC_HDR_COOKIE) ||

			ipa3_check_idr_if_freed(entry->proc_ctx)) {

			IPAERR_RL("Proc header entry already deleted\n");

			return -EPERM;

		}
@@ -1797,7 +1789,7 @@ static int __ipa_mdfy_rt_rule(struct ipa_rt_rule_mdfy *rtrule) 


	if (entry->hdr)

		entry->hdr->ref_cnt--;

	if (entry->proc_ctx)

	else if (entry->proc_ctx)

		entry->proc_ctx->ref_cnt--;



	entry->rule = rtrule->rule;