Merge "msm: ipa: Validate pdn_idx on modify_flt_rule" (81b3bf16) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/platform/msm/ipa/ipa_v3/ipa_flt.c

+3 −32

Original line number	Diff line number	Diff line
		@@ -1033,40 +1033,11 @@ static int __ipa_mdfy_flt_rule(struct ipa_flt_rule_mdfy *frule,
		goto error;
		}

		if (entry->rt_tbl)
		entry->rt_tbl->ref_cnt--;

		if (frule->rule.action != IPA_PASS_TO_EXCEPTION) {
		if (!frule->rule.eq_attrib_type) {
		if (!frule->rule.rt_tbl_hdl) {
		IPAERR_RL("invalid RT tbl\n");
		if (__ipa_validate_flt_rule(&frule->rule, &rt_tbl, ip))
		goto error;
		}

		rt_tbl = ipa3_id_find(frule->rule.rt_tbl_hdl);
		if (rt_tbl == NULL) {
		IPAERR_RL("RT tbl not found\n");
		goto error;
		}

		if (rt_tbl->cookie != IPA_RT_TBL_COOKIE) {
		IPAERR_RL("RT table cookie is invalid\n");
		goto error;
		}
		} else {
		if (frule->rule.rt_tbl_idx > ((ip == IPA_IP_v4) ?
		IPA_MEM_PART(v4_modem_rt_index_hi) :
		IPA_MEM_PART(v6_modem_rt_index_hi))) {
		IPAERR_RL("invalid RT tbl\n");
		goto error;
		}
		}
		} else {
		if (frule->rule.rt_tbl_idx > 0) {
		IPAERR_RL("invalid RT tbl\n");
		goto error;
		}
		}
		if (entry->rt_tbl)
		entry->rt_tbl->ref_cnt--;

		entry->rule = frule->rule;
		entry->rt_tbl = rt_tbl;