Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b8fc6129 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ipa: add additional checks to prevent use-after free errors"

parents 72fd24f8 d07a0727

drivers/platform/msm/ipa/ipa_v3/ipa_flt.c

+4 −2
Original line number Diff line number Diff line
@@ -71,7 +71,7 @@ static int ipa3_generate_flt_hw_rule(enum ipa_ip_type ip, 
	}



	gen_params.ipt = ip;

	if (entry->rt_tbl)

	if (entry->rt_tbl && (!ipa3_check_idr_if_freed(entry->rt_tbl)))

		gen_params.rt_tbl_idx = entry->rt_tbl->idx;

	else

		gen_params.rt_tbl_idx = entry->rule.rt_tbl_idx;
@@ -1824,7 +1824,9 @@ int ipa3_reset_flt(enum ipa_ip_type ip, bool user_only) 
					entry->ipacm_installed) {

				list_del(&entry->link);

				entry->tbl->rule_cnt--;

				if (entry->rt_tbl)

				if (entry->rt_tbl &&

					(!ipa3_check_idr_if_freed(

						entry->rt_tbl)))

					entry->rt_tbl->ref_cnt--;

				/* if rule id was allocated from idr, remove */

				rule_id = entry->rule_id;

drivers/platform/msm/ipa/ipa_v3/ipa_i.h

+2 −0
Original line number Diff line number Diff line
@@ -2858,6 +2858,8 @@ void ipa3_tag_destroy_imm(void *user1, int user2); 
const struct ipa_gsi_ep_config *ipa3_get_gsi_ep_info

	(enum ipa_client_type client);



bool ipa3_check_idr_if_freed(void *ptr);



int ipa3_wigig_init_i(void);

int ipa3_wigig_uc_init(

	struct ipa_wdi_uc_ready_params *inout,

drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+8 −3
Original line number Diff line number Diff line
@@ -104,6 +104,7 @@ static int ipa_generate_rt_hw_rule(enum ipa_ip_type ip, 


		proc_ctx = (entry->proc_ctx) ? : entry->hdr->proc_ctx;

		if ((proc_ctx == NULL) ||

			ipa3_check_idr_if_freed(proc_ctx) ||

			(proc_ctx->cookie != IPA_PROC_HDR_COOKIE)) {

			gen_params.hdr_type = IPAHAL_RT_RULE_HDR_NONE;

			gen_params.hdr_ofst = 0;
@@ -753,7 +754,8 @@ struct ipa3_rt_tbl *__ipa3_find_rt_tbl(enum ipa_ip_type ip, const char *name) 


	set = &ipa3_ctx->rt_tbl_set[ip];

	list_for_each_entry(entry, &set->head_rt_tbl_list, link) {

		if (!strcmp(name, entry->name))

		if (!ipa3_check_idr_if_freed(entry) &&

			!strcmp(name, entry->name))

			return entry;

	}
@@ -1753,7 +1755,8 @@ int __ipa3_del_rt_rule(u32 rule_hdl) 


	if (entry->hdr)

		__ipa3_release_hdr(entry->hdr->id);

	else if (entry->proc_ctx)

	else if (entry->proc_ctx &&

		(!ipa3_check_idr_if_freed(entry->proc_ctx)))

		__ipa3_release_hdr_proc_ctx(entry->proc_ctx->id);

	list_del(&entry->link);

	entry->tbl->rule_cnt--;
@@ -1954,7 +1957,9 @@ int ipa3_reset_rt(enum ipa_ip_type ip, bool user_only) 
				tbl->rule_cnt--;

				if (rule->hdr)

					__ipa3_release_hdr(rule->hdr->id);

				else if (rule->proc_ctx)

				else if (rule->proc_ctx &&

					(!ipa3_check_idr_if_freed(

						rule->proc_ctx)))

					__ipa3_release_hdr_proc_ctx(

						rule->proc_ctx->id);

				rule->cookie = 0;

drivers/platform/msm/ipa/ipa_v3/ipa_utils.c

+22 −0
Original line number Diff line number Diff line
@@ -6385,6 +6385,28 @@ int ipa3_disable_apps_wan_cons_deaggr(uint32_t agg_size, uint32_t agg_count) 
	return res;

}



/**

 * ipa3_check_idr_if_freed()-

 * To iterate through the list and check if ptr exists

 *

 * Return value: true/false depending upon found/not

 */

bool ipa3_check_idr_if_freed(void *ptr)

{

	int id;

	void *iter_ptr;



	spin_lock(&ipa3_ctx->idr_lock);

	idr_for_each_entry(&ipa3_ctx->ipa_idr, iter_ptr, id) {

		if ((uintptr_t)ptr == (uintptr_t)iter_ptr) {

			spin_unlock(&ipa3_ctx->idr_lock);

			return false;

		}

	}

	spin_unlock(&ipa3_ctx->idr_lock);

	return true;

}



static void *ipa3_get_ipc_logbuf(void)

{

	if (ipa3_ctx)