Merge "msm: ipa4: Add checks to prevent use-after-free errors" (b53bd50a) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/platform/msm/ipa/ipa_v3/ipa_debugfs.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -721,7 +721,8 @@ static ssize_t ipa3_read_rt(struct file file, char __user ubuf, size_t count,
		list_for_each_entry(tbl, &set->head_rt_tbl_list, link) {
		i = 0;
		list_for_each_entry(entry, &tbl->head_rt_rule_list, link) {
		if (entry->proc_ctx) {
		if (entry->proc_ctx &&
		(!ipa3_check_idr_if_freed(entry->proc_ctx))) {
		ofst = entry->proc_ctx->offset_entry->offset;
		ofst_words =
		(ofst +

+7 −4

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0-only
		/*
		* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
		* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
		*/

		#include <linux/bitops.h>
		@@ -1741,7 +1741,8 @@ int __ipa3_del_rt_rule(u32 rule_hdl)
		return -EINVAL;
		}

		if (!strcmp(entry->tbl->name, IPA_DFLT_RT_TBL_NAME)) {
		if (!ipa3_check_idr_if_freed(entry) &&
		!strcmp(entry->tbl->name, IPA_DFLT_RT_TBL_NAME)) {
		IPADBG("Deleting rule from default rt table idx=%u\n",
		entry->tbl->idx);
		if (entry->tbl->rule_cnt == 1) {
		@@ -1971,7 +1972,8 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only)
		}
		}
		tbl->rule_cnt--;
		if (rule->hdr)
		if (rule->hdr &&
		(!ipa3_check_idr_if_freed(rule->hdr)))
		__ipa3_release_hdr(rule->hdr->id);
		else if (rule->proc_ctx &&
		(!ipa3_check_idr_if_freed(
		@@ -2174,7 +2176,8 @@ static int __ipa_mdfy_rt_rule(struct ipa_rt_rule_mdfy_i *rtrule)
		goto error;
		}

		if (!strcmp(entry->tbl->name, IPA_DFLT_RT_TBL_NAME)) {
		if (!ipa3_check_idr_if_freed(entry) &&
		!strcmp(entry->tbl->name, IPA_DFLT_RT_TBL_NAME)) {
		IPAERR_RL("Default tbl rule cannot be modified\n");
		return -EINVAL;
		}

+2 −2

Original line number	Diff line number	Diff line
		@@ -6205,7 +6205,7 @@ void ipa3_counter_remove_hdl(int hdl)
		}
		/* remove counters belong to this hdl, set used back to 0 */
		offset = counter->hw_counter.start_id - 1;
		if (offset >= 0 && offset + counter->hw_counter.num_counters
		if (offset >= 0 && (offset + counter->hw_counter.num_counters)
		< IPA_FLT_RT_HW_COUNTER) {
		memset(&ipa3_ctx->flt_rt_counters.used_hw + offset,
		0, counter->hw_counter.num_counters * sizeof(bool));
		@@ -6214,7 +6214,7 @@ void ipa3_counter_remove_hdl(int hdl)
		goto err;
		}
		offset = counter->sw_counter.start_id - 1 - IPA_FLT_RT_HW_COUNTER;
		if (offset >= 0 && offset + counter->sw_counter.num_counters
		if (offset >= 0 && (offset + counter->sw_counter.num_counters)
		< IPA_FLT_RT_SW_COUNTER) {
		memset(&ipa3_ctx->flt_rt_counters.used_sw + offset,
		0, counter->sw_counter.num_counters * sizeof(bool));