Merge "msm: ipa: Fix to use after free issue" (d2ae07b1) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -53,7 +53,7 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
		int pipe_idx;

		if (buf == NULL) {
		memset(tmp, 0, IPA_RT_FLT_HW_RULE_BUF_SIZE);
		memset(tmp, 0, (IPA_RT_FLT_HW_RULE_BUF_SIZE/4));
		buf = (u8 *)tmp;
		}

		@@ -75,8 +75,15 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
		rule_hdr->u.hdr.pipe_dest_idx = pipe_idx;
		rule_hdr->u.hdr.system = !ipa_ctx->hdr_tbl_lcl;
		if (entry->hdr) {
		if (entry->hdr->cookie == IPA_HDR_COOKIE) {
		rule_hdr->u.hdr.hdr_offset =
		entry->hdr->offset_entry->offset >> 2;
		} else {
		IPAERR("Entry hdr deleted by user = %d cookie = %u\n",
		entry->hdr->user_deleted, entry->hdr->cookie);
		WARN_ON(1);
		rule_hdr->u.hdr.hdr_offset = 0;
		}
		} else {
		rule_hdr->u.hdr.hdr_offset = 0;
		}

+12 −5

Original line number	Diff line number	Diff line
		@@ -73,11 +73,18 @@ static int ipa_generate_rt_hw_rule(enum ipa_ip_type ip,
		struct ipa3_hdr_proc_ctx_entry *proc_ctx;

		proc_ctx = (entry->proc_ctx) ? : entry->hdr->proc_ctx;
		if ((proc_ctx == NULL) \|\|
		(proc_ctx->cookie != IPA_PROC_HDR_COOKIE)) {
		gen_params.hdr_type = IPAHAL_RT_RULE_HDR_NONE;
		gen_params.hdr_ofst = 0;
		} else {
		gen_params.hdr_lcl = ipa3_ctx->hdr_proc_ctx_tbl_lcl;
		gen_params.hdr_type = IPAHAL_RT_RULE_HDR_PROC_CTX;
		gen_params.hdr_ofst = proc_ctx->offset_entry->offset +
		ipa3_ctx->hdr_proc_ctx_tbl.start_offset;
		} else if (entry->hdr) {
		}
		} else if ((entry->hdr != NULL) &&
		(entry->hdr->cookie == IPA_HDR_COOKIE)) {
		gen_params.hdr_lcl = ipa3_ctx->hdr_tbl_lcl;
		gen_params.hdr_type = IPAHAL_RT_RULE_HDR_RAW;
		gen_params.hdr_ofst = entry->hdr->offset_entry->offset;