Merge "msm: ipa: Fix for missing int overflow check in the refcount library" (f0e53b09) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1363,6 +1363,10 @@ int ipa2_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup)
		mutex_lock(&ipa_ctx->lock);
		entry = __ipa_find_rt_tbl(lookup->ip, lookup->name);
		if (entry && entry->cookie == IPA_RT_TBL_COOKIE) {
		if (entry->ref_cnt == U32_MAX) {
		IPAERR("fail: ref count crossed limit\n");
		goto ret;
		}
		entry->ref_cnt++;
		lookup->hdl = entry->id;

		@@ -1372,6 +1376,8 @@ int ipa2_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup)

		result = 0;
		}

		ret:
		mutex_unlock(&ipa_ctx->lock);

		return result;

+6 −0

Original line number	Diff line number	Diff line
		@@ -1444,6 +1444,10 @@ int ipa3_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup)
		mutex_lock(&ipa3_ctx->lock);
		entry = __ipa3_find_rt_tbl(lookup->ip, lookup->name);
		if (entry && entry->cookie == IPA_RT_TBL_COOKIE) {
		if (entry->ref_cnt == U32_MAX) {
		IPAERR("fail: ref count crossed limit\n");
		goto ret;
		}
		entry->ref_cnt++;
		lookup->hdl = entry->id;

		@@ -1453,6 +1457,8 @@ int ipa3_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup)

		result = 0;
		}

		ret:
		mutex_unlock(&ipa3_ctx->lock);

		return result;