Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 632931bf authored by Utkarsh Saxena's avatar Utkarsh Saxena Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: Fix for missing int overflow check in the refcount library 



Overflow of reference counter can lead to memory leak.

Before incrementing the reference count, check with
U32_MAX and return for error check.

Change-Id: Ib96d36574ee086ec73c9836110cb2c98e8ae3d66
Acked-by: default avatarMohammed Javid <mjavid@qti.qualcomm.com>
Signed-off-by: default avatarUtkarsh Saxena <usaxena@codeaurora.org>
parent e68546c8

drivers/platform/msm/ipa/ipa_v2/ipa_rt.c

+6 −0
Original line number Diff line number Diff line
@@ -1353,6 +1353,10 @@ int ipa2_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup) 
	mutex_lock(&ipa_ctx->lock);

	entry = __ipa_find_rt_tbl(lookup->ip, lookup->name);

	if (entry && entry->cookie == IPA_COOKIE) {

		if (entry->ref_cnt == U32_MAX) {

			IPAERR("fail: ref count crossed limit\n");

			goto ret;

		}

		entry->ref_cnt++;

		lookup->hdl = entry->id;
@@ -1362,6 +1366,8 @@ int ipa2_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup) 


		result = 0;

	}



ret:

	mutex_unlock(&ipa_ctx->lock);



	return result;

drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+7 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1612,6 +1612,10 @@ int ipa3_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup) 
	mutex_lock(&ipa3_ctx->lock);

	entry = __ipa3_find_rt_tbl(lookup->ip, lookup->name);

	if (entry && entry->cookie == IPA_COOKIE) {

		if (entry->ref_cnt == U32_MAX) {

			IPAERR("fail: ref count crossed limit\n");

			goto ret;

		}

		entry->ref_cnt++;

		lookup->hdl = entry->id;
@@ -1621,6 +1625,8 @@ int ipa3_get_rt_tbl(struct ipa_ioc_get_rt_tbl *lookup) 


		result = 0;

	}



ret:

	mutex_unlock(&ipa3_ctx->lock);



	return result;