Merge "msm: ipa: fix potential race condition ioctls" (3eeaf124) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/platform/msm/ipa/ipa_v3/ipa.c

+64 −1

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
		*/

		#include <linux/clk.h>
		@@ -746,6 +746,15 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_add_rt_rule_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_add_rt_rule_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -841,6 +850,15 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -937,6 +955,15 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_add_rt_rule_after_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -1031,6 +1058,15 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -1124,6 +1160,15 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_add_flt_rule_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_add_flt_rule_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -1217,6 +1262,15 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_add_flt_rule_after_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_add_flt_rule_after_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {
		@@ -1311,6 +1365,15 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg)
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* add check in case user-space module compromised */
		if (unlikely(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->num_rules
		!= pre_entry)) {
		IPAERR_RL("current %d pre %d\n",
		((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->
		num_rules, pre_entry);
		retval = -EFAULT;
		goto free_param_kptr;
		}
		/* alloc kernel pointer with actual payload size */
		kptr = kzalloc(pyld_sz, GFP_KERNEL);
		if (!kptr) {