Merge "msm: ipa: Fix to use after free issue" (2e4d4e09) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+10 −3

Original line number	Diff line number	Diff line
		@@ -53,7 +53,7 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
		int pipe_idx;

		if (buf == NULL) {
		memset(tmp, 0, IPA_RT_FLT_HW_RULE_BUF_SIZE);
		memset(tmp, 0, (IPA_RT_FLT_HW_RULE_BUF_SIZE/4));
		buf = (u8 *)tmp;
		}

		@@ -75,8 +75,15 @@ int __ipa_generate_rt_hw_rule_v2(enum ipa_ip_type ip,
		rule_hdr->u.hdr.pipe_dest_idx = pipe_idx;
		rule_hdr->u.hdr.system = !ipa_ctx->hdr_tbl_lcl;
		if (entry->hdr) {
		if (entry->hdr->cookie == IPA_HDR_COOKIE) {
		rule_hdr->u.hdr.hdr_offset =
		entry->hdr->offset_entry->offset >> 2;
		} else {
		IPAERR("Entry hdr deleted by user = %d cookie = %u\n",
		entry->hdr->user_deleted, entry->hdr->cookie);
		WARN_ON(1);
		rule_hdr->u.hdr.hdr_offset = 0;
		}
		} else {
		rule_hdr->u.hdr.hdr_offset = 0;
		}

+15 −7

Original line number	Diff line number	Diff line
		@@ -83,13 +83,21 @@ int __ipa_generate_rt_hw_rule_v3_0(enum ipa_ip_type ip,
		if (entry->proc_ctx \|\| (entry->hdr && entry->hdr->is_hdr_proc_ctx)) {
		struct ipa3_hdr_proc_ctx_entry *proc_ctx;
		proc_ctx = (entry->proc_ctx) ? : entry->hdr->proc_ctx;
		rule_hdr->u.hdr.system = !ipa3_ctx->hdr_proc_ctx_tbl_lcl;
		if ((proc_ctx == NULL) \|\|
		(proc_ctx->cookie != IPA_PROC_HDR_COOKIE)) {
		rule_hdr->u.hdr.proc_ctx = 0;
		rule_hdr->u.hdr.hdr_offset = 0;
		} else {
		rule_hdr->u.hdr.system =
		!ipa3_ctx->hdr_proc_ctx_tbl_lcl;
		BUG_ON(proc_ctx->offset_entry->offset & 31);
		rule_hdr->u.hdr.proc_ctx = 1;
		rule_hdr->u.hdr.hdr_offset =
		(proc_ctx->offset_entry->offset +
		ipa3_ctx->hdr_proc_ctx_tbl.start_offset) >> 5;
		} else if (entry->hdr) {
		}
		} else if ((entry->hdr != NULL) &&
		(entry->hdr->cookie == IPA_HDR_COOKIE)) {
		rule_hdr->u.hdr.system = !ipa3_ctx->hdr_tbl_lcl;
		BUG_ON(entry->hdr->offset_entry->offset & 3);
		rule_hdr->u.hdr.proc_ctx = 0;