Loading drivers/platform/msm/ipa/ipa_v3/ipa.c +42 −49 Original line number Diff line number Diff line Loading @@ -1026,8 +1026,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_v2 ) + ((struct ipa_ioc_add_rt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; Loading @@ -1039,7 +1038,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1071,7 +1070,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_v2 *) Loading @@ -1086,13 +1085,13 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1142,8 +1141,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_ext_v2 ) + ((struct ipa_ioc_add_rt_rule_ext_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_ext_i) Loading @@ -1156,7 +1154,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1189,7 +1187,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), (void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, ((struct ipa_ioc_add_rt_rule_ext_v2 *) Loading @@ -1204,14 +1202,14 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1260,8 +1258,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_after_v2) + ((struct ipa_ioc_add_rt_rule_after_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) Loading @@ -1274,7 +1271,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1305,7 +1302,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_after_v2 *) Loading @@ -1320,13 +1317,13 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1375,8 +1372,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_rt_rule_v2) + ((struct ipa_ioc_mdfy_rt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_mdfy_i) Loading @@ -1389,7 +1385,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1420,7 +1416,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), (void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_rt_rule_v2 *) Loading @@ -1435,13 +1431,13 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1489,8 +1485,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_v2) + ((struct ipa_ioc_add_flt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) Loading @@ -1503,7 +1498,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1534,7 +1529,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), (void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_v2 *) Loading @@ -1549,13 +1544,13 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1603,8 +1598,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_after_v2) + ((struct ipa_ioc_add_flt_rule_after_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) Loading @@ -1617,7 +1611,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1648,7 +1642,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_after_v2 *) Loading @@ -1663,13 +1657,13 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1718,8 +1712,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_flt_rule_v2) + ((struct ipa_ioc_mdfy_flt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_mdfy_i) Loading @@ -1732,7 +1725,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1763,7 +1756,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), (void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_flt_rule_v2 *) Loading @@ -1778,13 +1771,13 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading
drivers/platform/msm/ipa/ipa_v3/ipa.c +42 −49 Original line number Diff line number Diff line Loading @@ -1026,8 +1026,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_v2 ) + ((struct ipa_ioc_add_rt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) * pre_entry; Loading @@ -1039,7 +1038,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1071,7 +1070,7 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_v2 *) Loading @@ -1086,13 +1085,13 @@ static int ipa3_ioctl_add_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_v2 *) header)->rule_add_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1142,8 +1141,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_ext_v2 ) + ((struct ipa_ioc_add_rt_rule_ext_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_ext_i) Loading @@ -1156,7 +1154,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1189,7 +1187,7 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), (void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, ((struct ipa_ioc_add_rt_rule_ext_v2 *) Loading @@ -1204,14 +1202,14 @@ static int ipa3_ioctl_add_rt_rule_ext_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_ext_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size, kptr + i * sizeof(struct ipa_rt_rule_add_ext_i), ((struct ipa_ioc_add_rt_rule_ext_v2 *) header)->rule_add_ext_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1260,8 +1258,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_rt_rule_after_v2) + ((struct ipa_ioc_add_rt_rule_after_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_add_i) Loading @@ -1274,7 +1271,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1305,7 +1302,7 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, ((struct ipa_ioc_add_rt_rule_after_v2 *) Loading @@ -1320,13 +1317,13 @@ static int ipa3_ioctl_add_rt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size, kptr + i * sizeof(struct ipa_rt_rule_add_i), ((struct ipa_ioc_add_rt_rule_after_v2 *) header)->rule_add_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1375,8 +1372,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_rt_rule_v2) + ((struct ipa_ioc_mdfy_rt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_rt_rule_mdfy_i) Loading @@ -1389,7 +1385,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1420,7 +1416,7 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), (void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_rt_rule_v2 *) Loading @@ -1435,13 +1431,13 @@ static int ipa3_ioctl_mdfy_rt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_mdfy_rt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_rt_rule_mdfy_i), ((struct ipa_ioc_mdfy_rt_rule_v2 *) header)->rule_mdfy_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1489,8 +1485,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_v2) + ((struct ipa_ioc_add_flt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) Loading @@ -1503,7 +1498,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1534,7 +1529,7 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), (void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_v2 *) Loading @@ -1549,13 +1544,13 @@ static int ipa3_ioctl_add_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_flt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_v2 *) header)->flt_rule_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1603,8 +1598,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_add_flt_rule_after_v2) + ((struct ipa_ioc_add_flt_rule_after_v2 *) usr_pyld_sz = ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_add_i) Loading @@ -1617,7 +1611,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1648,7 +1642,7 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_add_i), (void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, ((struct ipa_ioc_add_flt_rule_after_v2 *) Loading @@ -1663,13 +1657,13 @@ static int ipa3_ioctl_add_flt_rule_after_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_add_rt_rule_after_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size, kptr + i * sizeof(struct ipa_flt_rule_add_i), ((struct ipa_ioc_add_flt_rule_after_v2 *) header)->flt_rule_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading Loading @@ -1718,8 +1712,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* user payload size */ usr_pyld_sz = sizeof(struct ipa_ioc_mdfy_flt_rule_v2) + ((struct ipa_ioc_mdfy_flt_rule_v2 *) usr_pyld_sz = ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size * pre_entry; /* actual payload structure size in kernel */ pyld_sz = sizeof(struct ipa_flt_rule_mdfy_i) Loading @@ -1732,7 +1725,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } /* alloc param with same payload size as user payload */ param = memdup_user((const void __user *)arg, param = memdup_user((const void __user *)uptr, usr_pyld_sz); if (IS_ERR(param)) { retval = -EFAULT; Loading Loading @@ -1763,7 +1756,7 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) } for (i = 0; i < pre_entry; i++) memcpy(kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), (void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * (void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, ((struct ipa_ioc_mdfy_flt_rule_v2 *) Loading @@ -1778,13 +1771,13 @@ static int ipa3_ioctl_mdfy_flt_rule_v2(unsigned long arg) goto free_param_kptr; } for (i = 0; i < pre_entry; i++) memcpy((void *)(((struct ipa_ioc_mdfy_flt_rule_v2 *)param)->rules) + i * memcpy((void *)param + i * ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size, kptr + i * sizeof(struct ipa_flt_rule_mdfy_i), ((struct ipa_ioc_mdfy_flt_rule_v2 *) header)->rule_mdfy_size); if (copy_to_user((void __user *)arg, param, if (copy_to_user((void __user *)uptr, param, usr_pyld_sz)) { IPAERR_RL("copy_to_user fails\n"); retval = -EFAULT; Loading