Merge "msm: ipa: Fix boundary cross on array element" (f57bb090) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/platform/msm/ipa/ipa_v2/ipa_debugfs.c

+5 −5

Original line number	Original line	Diff line number	Diff line
	@@ -431,7 +431,7 @@ static ssize_t ipa_read_hdr(struct file file, char __user ubuf, size_t count,
	link) {		link) {
	nbytes = scnprintf(		nbytes = scnprintf(
	dbg_buff,		dbg_buff,
	IPA_MAX_MSG_LEN,		IPA_MAX_MSG_LEN - 1,
	"name:%s len=%d ref=%d partial=%d type=%s ",		"name:%s len=%d ref=%d partial=%d type=%s ",
	entry->name,		entry->name,
	entry->hdr_len,		entry->hdr_len,
	@@ -442,23 +442,23 @@ static ssize_t ipa_read_hdr(struct file file, char __user ubuf, size_t count,
	if (entry->is_hdr_proc_ctx) {		if (entry->is_hdr_proc_ctx) {
	nbytes += scnprintf(		nbytes += scnprintf(
	dbg_buff + nbytes,		dbg_buff + nbytes,
	IPA_MAX_MSG_LEN - nbytes,		IPA_MAX_MSG_LEN - 1 - nbytes,
	"phys_base=0x%pa ",		"phys_base=0x%pa ",
	&entry->phys_base);		&entry->phys_base);
	} else {		} else {
	nbytes += scnprintf(		nbytes += scnprintf(
	dbg_buff + nbytes,		dbg_buff + nbytes,
	IPA_MAX_MSG_LEN - nbytes,		IPA_MAX_MSG_LEN - 1 - nbytes,
	"ofst=%u ",		"ofst=%u ",
	entry->offset_entry->offset >> 2);		entry->offset_entry->offset >> 2);
	}		}
	for (i = 0; i < entry->hdr_len; i++) {		for (i = 0; i < entry->hdr_len; i++) {
	scnprintf(dbg_buff + nbytes + i * 2,		scnprintf(dbg_buff + nbytes + i * 2,
	IPA_MAX_MSG_LEN - nbytes - i * 2,		IPA_MAX_MSG_LEN - 1 - nbytes - i * 2,
	"%02x", entry->hdr[i]);		"%02x", entry->hdr[i]);
	}		}
	scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,		scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,
	IPA_MAX_MSG_LEN - nbytes - entry->hdr_len * 2,		IPA_MAX_MSG_LEN - 1 - nbytes - entry->hdr_len * 2,
	"\n");		"\n");
	pr_err("%s", dbg_buff);		pr_err("%s", dbg_buff);
	}		}

drivers/platform/msm/ipa/ipa_v3/ipa_debugfs.c

+5 −5

Original line number	Original line	Diff line number	Diff line
	@@ -358,7 +358,7 @@ static ssize_t ipa3_read_hdr(struct file file, char __user ubuf, size_t count,
	link) {		link) {
	nbytes = scnprintf(		nbytes = scnprintf(
	dbg_buff,		dbg_buff,
	IPA_MAX_MSG_LEN,		IPA_MAX_MSG_LEN - 1,
	"name:%s len=%d ref=%d partial=%d type=%s ",		"name:%s len=%d ref=%d partial=%d type=%s ",
	entry->name,		entry->name,
	entry->hdr_len,		entry->hdr_len,
	@@ -369,23 +369,23 @@ static ssize_t ipa3_read_hdr(struct file file, char __user ubuf, size_t count,
	if (entry->is_hdr_proc_ctx) {		if (entry->is_hdr_proc_ctx) {
	nbytes += scnprintf(		nbytes += scnprintf(
	dbg_buff + nbytes,		dbg_buff + nbytes,
	IPA_MAX_MSG_LEN - nbytes,		IPA_MAX_MSG_LEN - 1 - nbytes,
	"phys_base=0x%pa ",		"phys_base=0x%pa ",
	&entry->phys_base);		&entry->phys_base);
	} else {		} else {
	nbytes += scnprintf(		nbytes += scnprintf(
	dbg_buff + nbytes,		dbg_buff + nbytes,
	IPA_MAX_MSG_LEN - nbytes,		IPA_MAX_MSG_LEN - 1 - nbytes,
	"ofst=%u ",		"ofst=%u ",
	entry->offset_entry->offset >> 2);		entry->offset_entry->offset >> 2);
	}		}
	for (i = 0; i < entry->hdr_len; i++) {		for (i = 0; i < entry->hdr_len; i++) {
	scnprintf(dbg_buff + nbytes + i * 2,		scnprintf(dbg_buff + nbytes + i * 2,
	IPA_MAX_MSG_LEN - nbytes - i * 2,		IPA_MAX_MSG_LEN - 1 - nbytes - i * 2,
	"%02x", entry->hdr[i]);		"%02x", entry->hdr[i]);
	}		}
	scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,		scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,
	IPA_MAX_MSG_LEN - nbytes - entry->hdr_len * 2,		IPA_MAX_MSG_LEN - 1 - nbytes - entry->hdr_len * 2,
	"\n");		"\n");
	pr_err("%s", dbg_buff);		pr_err("%s", dbg_buff);
	}		}