Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a170ff9 authored by Jagadeesh Ponduru's avatar Jagadeesh Ponduru Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa3: fix pointer arithmetic to avoid out-of-bound 

When offset gets added to base of the array, it returns
offset plus the number equal to size of the whole array.
So, correct it by passing the address of offset element
in the array.

Change-Id: I8a087ca277bdc476674c7221b5fc0920e6986570
parent 4763ef46

drivers/platform/msm/ipa/ipa_v3/ipa_utils.c

+2 −2
Original line number Diff line number Diff line
@@ -7281,7 +7281,7 @@ void ipa3_counter_remove_hdl(int hdl) 
	offset = counter->hw_counter.start_id - 1;

	if (offset >= 0 && (offset + counter->hw_counter.num_counters)

		< IPA_FLT_RT_HW_COUNTER) {

		memset(&ipa3_ctx->flt_rt_counters.used_hw + offset,

		memset(&ipa3_ctx->flt_rt_counters.used_hw[offset],

			   0, counter->hw_counter.num_counters * sizeof(bool));

	} else {

		IPAERR_RL("unexpected hdl %d\n", hdl);
@@ -7290,7 +7290,7 @@ void ipa3_counter_remove_hdl(int hdl) 
	offset = counter->sw_counter.start_id - 1 - IPA_FLT_RT_HW_COUNTER;

	if (offset >= 0 && (offset + counter->sw_counter.num_counters)

		< IPA_FLT_RT_SW_COUNTER) {

		memset(&ipa3_ctx->flt_rt_counters.used_sw + offset,

		memset(&ipa3_ctx->flt_rt_counters.used_sw[offset],

		   0, counter->sw_counter.num_counters * sizeof(bool));

	} else {

		IPAERR_RL("unexpected hdl %d\n", hdl);