Merge "msm:ipa:Prevent rt rule deletion if rt rule id is invalid" (d256ea43) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+23 −0

Original line number	Diff line number	Diff line
		@@ -1344,6 +1344,8 @@ int ipa2_reset_rt(enum ipa_ip_type ip, bool user_only)
		struct ipa_rt_entry *rule_next;
		struct ipa_rt_tbl_set *rset;
		u32 apps_start_idx;
		struct ipa_hdr_entry *hdr_entry;
		struct ipa_hdr_proc_ctx_entry *hdr_proc_entry;
		int id;
		bool tbl_user = false;

		@@ -1397,6 +1399,27 @@ int ipa2_reset_rt(enum ipa_ip_type ip, bool user_only)
		if (!user_only \|\|
		rule->ipacm_installed) {
		list_del(&rule->link);
		if (rule->hdr) {
		hdr_entry = ipa_id_find(
		rule->rule.hdr_hdl);
		if (!hdr_entry \|\|
		hdr_entry->cookie != IPA_HDR_COOKIE) {
		IPAERR_RL(
		"Header already deleted\n");
		return -EINVAL;
		}
		} else if (rule->proc_ctx) {
		hdr_proc_entry =
		ipa_id_find(
		rule->rule.hdr_proc_ctx_hdl);
		if (!hdr_proc_entry \|\|
		hdr_proc_entry->cookie !=
		IPA_PROC_HDR_COOKIE) {
		IPAERR_RL(
		"Proc entry already deleted\n");
		return -EINVAL;
		}
		}
		tbl->rule_cnt--;
		if (rule->hdr)
		__ipa_release_hdr(rule->hdr->id);

+26 −1

Original line number	Diff line number	Diff line
		@@ -1487,6 +1487,8 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only)
		struct ipa3_rt_entry *rule;
		struct ipa3_rt_entry *rule_next;
		struct ipa3_rt_tbl_set *rset;
		struct ipa3_hdr_entry *hdr_entry;
		struct ipa3_hdr_proc_ctx_entry *hdr_proc_entry;
		u32 apps_start_idx;
		int id;
		bool tbl_user = false;
		@@ -1540,6 +1542,27 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only)
		if (!user_only \|\|
		rule->ipacm_installed) {
		list_del(&rule->link);
		if (rule->hdr) {
		hdr_entry = ipa3_id_find(
		rule->rule.hdr_hdl);
		if (!hdr_entry \|\|
		hdr_entry->cookie != IPA_HDR_COOKIE) {
		IPAERR_RL(
		"Header already deleted\n");
		return -EINVAL;
		}
		} else if (rule->proc_ctx) {
		hdr_proc_entry =
		ipa3_id_find(
		rule->rule.hdr_proc_ctx_hdl);
		if (!hdr_proc_entry \|\|
		hdr_proc_entry->cookie !=
		IPA_PROC_HDR_COOKIE) {
		IPAERR_RL(
		"Proc entry already deleted\n");
		return -EINVAL;
		}
		}
		tbl->rule_cnt--;
		if (rule->hdr)
		__ipa3_release_hdr(rule->hdr->id);
		@@ -1547,7 +1570,9 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only)
		__ipa3_release_hdr_proc_ctx(
		rule->proc_ctx->id);
		rule->cookie = 0;
		idr_remove(tbl->rule_ids, rule->rule_id);
		if (!rule->rule_id_valid)
		idr_remove(tbl->rule_ids,
		rule->rule_id);
		id = rule->id;
		kmem_cache_free(ipa3_ctx->rt_rule_cache, rule);