Merge "msm: ipa: Fix array out of bound and use after NULL check" (1fe3b507) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/platform/msm/ipa/ipa_rm_dependency_graph.c

+5 −3

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
		* Copyright (c) 2013-2018, 2021, The Linux Foundation. All rights reserved.
		*/

		#include <linux/slab.h>
		@@ -77,7 +77,8 @@ int ipa_rm_dep_graph_get_resource(
		goto bail;
		}
		resource_index = ipa_rm_dep_get_index(resource_name);
		if (resource_index == IPA_RM_INDEX_INVALID) {
		if (resource_index == IPA_RM_INDEX_INVALID \|\|
		resource_index >= IPA_RM_RESOURCE_MAX) {
		result = -EINVAL;
		goto bail;
		}
		@@ -109,7 +110,8 @@ int ipa_rm_dep_graph_add(struct ipa_rm_dep_graph *graph,
		goto bail;
		}
		resource_index = ipa_rm_dep_get_index(resource->name);
		if (resource_index == IPA_RM_INDEX_INVALID) {
		if (resource_index == IPA_RM_INDEX_INVALID \|\|
		resource_index >= IPA_RM_RESOURCE_MAX) {
		result = -EINVAL;
		goto bail;
		}

+18 −2

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2014-2018, 2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014-2018, 2020-2021, The Linux Foundation. All rights reserved.
		*/

		/*
		@@ -2837,6 +2837,16 @@ static int rmnet_ipa_query_tethering_stats_modem(
		struct ipa_get_data_stats_resp_msg_v01 *resp;
		int pipe_len, rc;

		if (data != NULL) {
		/* prevent string buffer overflows */
		data->upstreamIface[IFNAMSIZ-1] = '\0';
		data->tetherIface[IFNAMSIZ-1] = '\0';
		} else if (!reset) {
		/* only reset can have data == NULL*/
		IPAWANERR("query without allocate tether_stats strucutre\n");
		return -EINVAL;
		}

		req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),
		GFP_KERNEL);
		if (!req) {
		@@ -2860,7 +2870,13 @@ static int rmnet_ipa_query_tethering_stats_modem(
		IPAWANDBG("reset the pipe stats\n");
		} else {
		/* print tethered-client enum */
		IPAWANDBG_LOW("Tethered-client enum(%d)\n", data->ipa_client);
		if (data == NULL) {
		kfree(req);
		kfree(resp);
		return -EINVAL;
		}
		IPAWANDBG_LOW("Tethered-client enum(%d)\n",
		data->ipa_client);
		}

		rc = ipa_qmi_get_data_stats(req, resp);

+11 −1

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
		*/

		/*
		@@ -3268,6 +3268,16 @@ static int rmnet_ipa3_query_tethering_stats_modem(
		int pipe_len, rc;
		struct ipa_pipe_stats_info_type_v01 *stat_ptr;

		if (data != NULL) {
		/* prevent string buffer overflows */
		data->upstreamIface[IFNAMSIZ-1] = '\0';
		data->tetherIface[IFNAMSIZ-1] = '\0';
		} else if (!reset) {
		/* only reset can have data == NULL */
		IPAWANERR("query without allocate tether_stats strucutre\n");
		return -EINVAL;
		}

		req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),
		GFP_KERNEL);
		if (!req)