Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db6035b7 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "ipa: Remove overwrite copy"

parents 92dd4920 657fc562

drivers/platform/msm/ipa/ipa_v2/ipa.c

+18 −77
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2012-2018, 2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2018, 2020-2021, The Linux Foundation. All rights reserved.

 */



#include <linux/clk.h>
@@ -654,15 +654,11 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_nat_dma_cmd) +

		   pre_entry * sizeof(struct ipa_ioc_nat_dma_one);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}



		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_nat_dma_cmd *)param)->entries

			!= pre_entry)) {
@@ -702,14 +698,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_add_hdr) +

		   pre_entry * sizeof(struct ipa_hdr_add);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_add_hdr *)param)->num_hdrs

			!= pre_entry)) {
@@ -742,14 +734,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_del_hdr) +

		   pre_entry * sizeof(struct ipa_hdr_del);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_del_hdr *)param)->num_hdls

			!= pre_entry)) {
@@ -782,14 +770,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_add_rt_rule) +

		   pre_entry * sizeof(struct ipa_rt_rule_add);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_add_rt_rule *)param)->num_rules

			!= pre_entry)) {
@@ -823,14 +807,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_mdfy_rt_rule) +

		   pre_entry * sizeof(struct ipa_rt_rule_mdfy);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_mdfy_rt_rule *)param)->num_rules

			!= pre_entry)) {
@@ -863,14 +843,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_del_rt_rule) +

		   pre_entry * sizeof(struct ipa_rt_rule_del);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_del_rt_rule *)param)->num_hdls

			!= pre_entry)) {
@@ -902,14 +878,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_add_flt_rule) +

		   pre_entry * sizeof(struct ipa_flt_rule_add);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_add_flt_rule *)param)->num_rules

			!= pre_entry)) {
@@ -943,14 +915,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_del_flt_rule) +

		   pre_entry * sizeof(struct ipa_flt_rule_del);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_del_flt_rule *)param)->num_hdls

			!= pre_entry)) {
@@ -983,14 +951,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_mdfy_flt_rule) +

		   pre_entry * sizeof(struct ipa_flt_rule_mdfy);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_mdfy_flt_rule *)param)->num_rules

			!= pre_entry)) {
@@ -1120,14 +1084,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		pyld_sz = sz + pre_entry *

			sizeof(struct ipa_ioc_tx_intf_prop);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_query_intf_tx_props *)

			param)->num_tx_props
@@ -1166,14 +1126,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		pyld_sz = sz + pre_entry *

			sizeof(struct ipa_ioc_rx_intf_prop);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_query_intf_rx_props *)

			param)->num_rx_props != pre_entry)) {
@@ -1211,14 +1167,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		pyld_sz = sz + pre_entry *

			sizeof(struct ipa_ioc_ext_intf_prop);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_query_intf_ext_props *)

			param)->num_ext_props != pre_entry)) {
@@ -1249,14 +1201,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		pyld_sz = sizeof(struct ipa_msg_meta) +

		   pre_entry;

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_msg_meta *)param)->msg_len

			!= pre_entry)) {
@@ -1389,14 +1337,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_add_hdr_proc_ctx) +

		   pre_entry * sizeof(struct ipa_hdr_proc_ctx_add);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_add_hdr_proc_ctx *)

			param)->num_proc_ctxs != pre_entry)) {
@@ -1428,14 +1372,10 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		   sizeof(struct ipa_ioc_del_hdr_proc_ctx) +

		   pre_entry * sizeof(struct ipa_hdr_proc_ctx_del);

		param = memdup_user((const void __user *)arg, pyld_sz);

		if (!param) {

		if (IS_ERR(param)) {

			retval = -ENOMEM;

			break;

		}

		if (copy_from_user(param, (const void __user *)arg, pyld_sz)) {

			retval = -EFAULT;

			break;

		}

		/* add check in case user-space module compromised */

		if (unlikely(((struct ipa_ioc_del_hdr_proc_ctx *)

			param)->num_hdls != pre_entry)) {
@@ -1490,6 +1430,7 @@ static long ipa_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		IPA_ACTIVE_CLIENTS_DEC_SIMPLE();

		return -ENOTTY;

	}

	if (!IS_ERR(param))

		kfree(param);



	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();