Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d78eaea3 authored by Mohammed Javid's avatar Mohammed Javid Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa3: Fix to validate the user inputs 



Adding code changes to validate user inputs.
Before allocating the NAT entry verifying the
NAT entry size in range or not.

Change-Id: I47b97973a3ea66b1627a323f77778b295c7765a4
Acked-by: default avatarAshok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent 947c85b6

drivers/platform/msm/ipa/ipa_v3/ipa_nat.c

+22 −3
Original line number Diff line number Diff line
@@ -31,6 +31,13 @@ 
#define IPA_IPV6CT_MAX_NUM_OF_INIT_CMD_DESC 2

#define IPA_MAX_NUM_OF_TABLE_DMA_CMD_DESC 4



/*

 * The base table max entries is limited by index into table 13 bits number.

 * Limit the memory size required by user to prevent kernel memory starvation

 */

#define IPA_TABLE_MAX_ENTRIES 8192

#define MAX_ALLOC_NAT_SIZE(size) (IPA_TABLE_MAX_ENTRIES * size)



enum ipa_nat_ipv6ct_table_type {

	IPA_NAT_BASE_TBL = 0,

	IPA_NAT_EXPN_TBL = 1,
@@ -337,10 +344,12 @@ void ipa3_nat_ipv6ct_destroy_devices(void) 
}



static int ipa3_nat_ipv6ct_allocate_mem(struct ipa3_nat_ipv6ct_common_mem *dev,

	struct ipa_ioc_nat_ipv6ct_table_alloc *table_alloc)

	struct ipa_ioc_nat_ipv6ct_table_alloc *table_alloc,

	enum ipahal_nat_type nat_type)

{

	gfp_t gfp_flags = GFP_KERNEL | __GFP_ZERO;

	int result = 0;

	size_t nat_entry_size;



	IPADBG("passed memory size %zu for %s\n",

		table_alloc->size, dev->name);
@@ -357,6 +366,15 @@ static int ipa3_nat_ipv6ct_allocate_mem(struct ipa3_nat_ipv6ct_common_mem *dev, 
		goto bail;

	}



	ipahal_nat_entry_size(nat_type, &nat_entry_size);

	if (table_alloc->size > MAX_ALLOC_NAT_SIZE(nat_entry_size)) {

		IPAERR("Trying allocate more size = %zu, Max allowed = %zu\n",

				table_alloc->size,

				MAX_ALLOC_NAT_SIZE(nat_entry_size));

		result = -EPERM;

		goto bail;

	}



	if (!table_alloc->size) {

		IPAERR_RL("Invalid Parameters\n");

		result = -EPERM;
@@ -432,7 +450,8 @@ int ipa3_allocate_nat_table(struct ipa_ioc_nat_ipv6ct_table_alloc *table_alloc) 


	mutex_lock(&nat_ctx->dev.lock);



	result = ipa3_nat_ipv6ct_allocate_mem(&nat_ctx->dev, table_alloc);

	result = ipa3_nat_ipv6ct_allocate_mem(&nat_ctx->dev, table_alloc,

							IPAHAL_NAT_IPV4);

	if (result)

		goto bail;
@@ -506,7 +525,7 @@ int ipa3_allocate_ipv6ct_table( 
	mutex_lock(&ipa3_ctx->ipv6ct_mem.dev.lock);



	result = ipa3_nat_ipv6ct_allocate_mem(

		&ipa3_ctx->ipv6ct_mem.dev, table_alloc);

		&ipa3_ctx->ipv6ct_mem.dev, table_alloc, IPAHAL_NAT_IPV6CT);

	if (result)

		goto bail;