Merge "msm: ipa: Fix to slab out of bounds issue" (fcd41ec9) · Commits · e / devices / android_kernel_sony_msm8998

drivers/platform/msm/ipa/ipa_v2/ipa_debugfs.c

+50 −8

Original line number	Diff line number	Diff line
		@@ -426,6 +426,8 @@ static ssize_t ipa_read_hdr(struct file file, char __user ubuf, size_t count,

		list_for_each_entry(entry, &ipa_ctx->hdr_tbl.head_hdr_entry_list,
		link) {
		if (entry->cookie != IPA_HDR_COOKIE)
		continue;
		nbytes = scnprintf(
		dbg_buff,
		IPA_MAX_MSG_LEN,
		@@ -591,6 +593,14 @@ static int ipa_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		if (attrib->protocol_eq_present)
		pr_err("protocol:%d ", attrib->protocol_eq);

		if (attrib->num_ihl_offset_range_16 >
		IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS) {
		IPAERR_RL("num_ihl_offset_range_16 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS,
		attrib->num_ihl_offset_range_16);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_ihl_offset_range_16; i++) {
		pr_err(
		"(ihl_ofst_range16: ofst:%u lo:%u hi:%u) ",
		@@ -599,6 +609,12 @@ static int ipa_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		attrib->ihl_offset_range_16[i].range_high);
		}

		if (attrib->num_offset_meq_32 > IPA_IPFLTR_NUM_MEQ_32_EQNS) {
		IPAERR_RL("num_offset_meq_32 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_MEQ_32_EQNS, attrib->num_offset_meq_32);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_offset_meq_32; i++) {
		pr_err(
		"(ofst_meq32: ofst:%u mask:0x%x val:0x%x) ",
		@@ -620,6 +636,12 @@ static int ipa_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		attrib->ihl_offset_eq_16.value);
		}

		if (attrib->num_ihl_offset_meq_32 > IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS) {
		IPAERR_RL("num_ihl_offset_meq_32 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS, attrib->num_ihl_offset_meq_32);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_ihl_offset_meq_32; i++) {
		pr_err(
		"(ihl_ofst_meq32: ofts:%d mask:0x%x val:0x%x) ",
		@@ -628,6 +650,12 @@ static int ipa_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		attrib->ihl_offset_meq_32[i].value);
		}

		if (attrib->num_offset_meq_128 > IPA_IPFLTR_NUM_MEQ_128_EQNS) {
		IPAERR_RL("num_offset_meq_128 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_MEQ_128_EQNS, attrib->num_offset_meq_128);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_offset_meq_128; i++) {
		for (j = 0; j < 16; j++) {
		addr[j] = attrib->offset_meq_128[i].value[j];
		@@ -797,11 +825,14 @@ static ssize_t ipa_read_flt(struct file file, char __user ubuf, size_t count,
		u32 rt_tbl_idx;
		u32 bitmap;
		bool eq;
		int res = 0;

		tbl = &ipa_ctx->glob_flt_tbl[ip];
		mutex_lock(&ipa_ctx->lock);
		i = 0;
		list_for_each_entry(entry, &tbl->head_flt_rule_list, link) {
		if (entry->cookie != IPA_FLT_COOKIE)
		continue;
		if (entry->rule.eq_attrib_type) {
		rt_tbl_idx = entry->rule.rt_tbl_idx;
		bitmap = entry->rule.eq_attrib.rule_eq_bitmap;
		@@ -820,10 +851,14 @@ static ssize_t ipa_read_flt(struct file file, char __user ubuf, size_t count,
		i, entry->rule.action, rt_tbl_idx);
		pr_err("attrib_mask:%08x retain_hdr:%d eq:%d ",
		bitmap, entry->rule.retain_hdr, eq);
		if (eq)
		ipa_attrib_dump_eq(
		if (eq) {
		res = ipa_attrib_dump_eq(
		&entry->rule.eq_attrib);
		else
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		} else
		ipa_attrib_dump(
		&entry->rule.attrib, ip);
		i++;
		@@ -833,6 +868,8 @@ static ssize_t ipa_read_flt(struct file file, char __user ubuf, size_t count,
		tbl = &ipa_ctx->flt_tbl[j][ip];
		i = 0;
		list_for_each_entry(entry, &tbl->head_flt_rule_list, link) {
		if (entry->cookie != IPA_FLT_COOKIE)
		continue;
		if (entry->rule.eq_attrib_type) {
		rt_tbl_idx = entry->rule.rt_tbl_idx;
		bitmap = entry->rule.eq_attrib.rule_eq_bitmap;
		@@ -852,18 +889,23 @@ static ssize_t ipa_read_flt(struct file file, char __user ubuf, size_t count,
		pr_err("attrib_mask:%08x retain_hdr:%d ",
		bitmap, entry->rule.retain_hdr);
		pr_err("eq:%d ", eq);
		if (eq)
		ipa_attrib_dump_eq(
		if (eq) {
		res = ipa_attrib_dump_eq(
		&entry->rule.eq_attrib);
		else
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		} else
		ipa_attrib_dump(
		&entry->rule.attrib, ip);
		i++;
		}
		}
		bail:
		mutex_unlock(&ipa_ctx->lock);

		return 0;
		return res;
		}

		static ssize_t ipa_read_stats(struct file file, char __user ubuf,

drivers/platform/msm/ipa/ipa_v3/ipa_debugfs.c

+60 −8

Original line number	Diff line number	Diff line
		@@ -351,6 +351,8 @@ static ssize_t ipa3_read_hdr(struct file file, char __user ubuf, size_t count,

		list_for_each_entry(entry, &ipa3_ctx->hdr_tbl.head_hdr_entry_list,
		link) {
		if (entry->cookie != IPA_HDR_COOKIE)
		continue;
		nbytes = scnprintf(
		dbg_buff,
		IPA_MAX_MSG_LEN,
		@@ -519,6 +521,12 @@ static int ipa3_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		if (attrib->tc_eq_present)
		pr_err("tc:%d ", attrib->tc_eq);

		if (attrib->num_offset_meq_128 > IPA_IPFLTR_NUM_MEQ_128_EQNS) {
		IPAERR_RL("num_offset_meq_128 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_MEQ_128_EQNS, attrib->num_offset_meq_128);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_offset_meq_128; i++) {
		for (j = 0; j < 16; j++) {
		addr[j] = attrib->offset_meq_128[i].value[j];
		@@ -530,6 +538,12 @@ static int ipa3_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		mask, addr);
		}

		if (attrib->num_offset_meq_32 > IPA_IPFLTR_NUM_MEQ_32_EQNS) {
		IPAERR_RL("num_offset_meq_32 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_MEQ_32_EQNS, attrib->num_offset_meq_32);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_offset_meq_32; i++)
		pr_err(
		"(ofst_meq32: ofst:%u mask:0x%x val:0x%x) ",
		@@ -537,6 +551,12 @@ static int ipa3_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		attrib->offset_meq_32[i].mask,
		attrib->offset_meq_32[i].value);

		if (attrib->num_ihl_offset_meq_32 > IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS) {
		IPAERR_RL("num_ihl_offset_meq_32 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_IHL_MEQ_32_EQNS, attrib->num_ihl_offset_meq_32);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_ihl_offset_meq_32; i++)
		pr_err(
		"(ihl_ofst_meq32: ofts:%d mask:0x%x val:0x%x) ",
		@@ -551,6 +571,14 @@ static int ipa3_attrib_dump_eq(struct ipa_ipfltri_rule_eq *attrib)
		attrib->metadata_meq32.mask,
		attrib->metadata_meq32.value);

		if (attrib->num_ihl_offset_range_16 >
		IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS) {
		IPAERR_RL("num_ihl_offset_range_16 Max %d passed value %d\n",
		IPA_IPFLTR_NUM_IHL_RANGE_16_EQNS,
		attrib->num_ihl_offset_range_16);
		return -EPERM;
		}

		for (i = 0; i < attrib->num_ihl_offset_range_16; i++)
		pr_err(
		"(ihl_ofst_range16: ofst:%u lo:%u hi:%u) ",
		@@ -743,7 +771,11 @@ static ssize_t ipa3_read_rt_hw(struct file file, char __user ubuf,
		pr_err("rule_id:%u prio:%u retain_hdr:%u ",
		rules[rl].id, rules[rl].priority,
		rules[rl].retain_hdr);
		ipa3_attrib_dump_eq(&rules[rl].eq_attrib);
		res = ipa3_attrib_dump_eq(&rules[rl].eq_attrib);
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		}

		pr_err("=== Routing Table %d = Non-Hashable Rules ===\n", tbl);
		@@ -774,7 +806,11 @@ static ssize_t ipa3_read_rt_hw(struct file file, char __user ubuf,
		pr_err("rule_id:%u prio:%u retain_hdr:%u\n",
		rules[rl].id, rules[rl].priority,
		rules[rl].retain_hdr);
		ipa3_attrib_dump_eq(&rules[rl].eq_attrib);
		res = ipa3_attrib_dump_eq(&rules[rl].eq_attrib);
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		}
		pr_err("\n");
		}
		@@ -848,6 +884,7 @@ static ssize_t ipa3_read_flt(struct file file, char __user ubuf, size_t count,
		u32 rt_tbl_idx;
		u32 bitmap;
		bool eq;
		int res = 0;

		mutex_lock(&ipa3_ctx->lock);

		@@ -857,6 +894,8 @@ static ssize_t ipa3_read_flt(struct file file, char __user ubuf, size_t count,
		tbl = &ipa3_ctx->flt_tbl[j][ip];
		i = 0;
		list_for_each_entry(entry, &tbl->head_flt_rule_list, link) {
		if (entry->cookie != IPA_FLT_COOKIE)
		continue;
		if (entry->rule.eq_attrib_type) {
		rt_tbl_idx = entry->rule.rt_tbl_idx;
		bitmap = entry->rule.eq_attrib.rule_eq_bitmap;
		@@ -878,18 +917,23 @@ static ssize_t ipa3_read_flt(struct file file, char __user ubuf, size_t count,
		pr_err("hashable:%u rule_id:%u max_prio:%u prio:%u ",
		entry->rule.hashable, entry->rule_id,
		entry->rule.max_prio, entry->prio);
		if (eq)
		ipa3_attrib_dump_eq(
		if (eq) {
		res = ipa3_attrib_dump_eq(
		&entry->rule.eq_attrib);
		else
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		} else
		ipa3_attrib_dump(
		&entry->rule.attrib, ip);
		i++;
		}
		}
		bail:
		mutex_unlock(&ipa3_ctx->lock);

		return 0;
		return res;
		}

		static ssize_t ipa3_read_flt_hw(struct file file, char __user ubuf,
		@@ -940,7 +984,11 @@ static ssize_t ipa3_read_flt_hw(struct file file, char __user ubuf,
		bitmap, rules[rl].rule.retain_hdr);
		pr_err("rule_id:%u prio:%u ",
		rules[rl].id, rules[rl].priority);
		ipa3_attrib_dump_eq(&rules[rl].rule.eq_attrib);
		res = ipa3_attrib_dump_eq(&rules[rl].rule.eq_attrib);
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		}

		pr_err("=== Filtering Table ep:%d = Non-Hashable Rules ===\n",
		@@ -964,7 +1012,11 @@ static ssize_t ipa3_read_flt_hw(struct file file, char __user ubuf,
		bitmap, rules[rl].rule.retain_hdr);
		pr_err("rule_id:%u prio:%u ",
		rules[rl].id, rules[rl].priority);
		ipa3_attrib_dump_eq(&rules[rl].rule.eq_attrib);
		res = ipa3_attrib_dump_eq(&rules[rl].rule.eq_attrib);
		if (res) {
		IPAERR_RL("failed read attrib eq\n");
		goto bail;
		}
		}
		pr_err("\n");
		}

drivers/platform/msm/ipa/ipa_v3/ipa_flt.c

+4 −2

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -61,8 +61,10 @@ static int ipa3_generate_flt_hw_rule(enum ipa_ip_type ip,
		gen_params.rule = (const struct ipa_flt_rule *)&entry->rule;

		res = ipahal_flt_generate_hw_rule(&gen_params, &entry->hw_len, buf);
		if (res)
		if (res) {
		IPAERR_RL("failed to generate flt h/w rule\n");
		return res;
		}

		return 0;
		}