소스 검색

msm: ipa3: Add check to validate rule_cnt

Add proper check to validate table rule count
which may lead to overflow error.

Change-Id: I9bdcafcaae4e4cff1b901929c8dc6ae804f85642
Signed-off-by: Praveen Kurapati <[email protected]>
Praveen Kurapati 4 년 전
부모
커밋
99c90b47f8
3개의 변경된 파일10개의 추가작업 그리고 2개의 파일을 삭제
  1. 4 1
      drivers/platform/msm/ipa/ipa_v3/ipa_flt.c
  2. 2 0
      drivers/platform/msm/ipa/ipa_v3/ipa_i.h
  3. 4 1
      drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

+ 4 - 1
drivers/platform/msm/ipa/ipa_v3/ipa_flt.c

@@ -975,7 +975,10 @@ static int __ipa_finish_flt_rule_add(struct ipa3_flt_tbl *tbl,
 {
 	int id;
 
-	tbl->rule_cnt++;
+	if (tbl->rule_cnt < IPA_RULE_CNT_MAX)
+		tbl->rule_cnt++;
+	else
+		return -EINVAL;
 	if (entry->rt_tbl)
 		entry->rt_tbl->ref_cnt++;
 	id = ipa3_id_alloc(entry);

+ 2 - 0
drivers/platform/msm/ipa/ipa_v3/ipa_i.h

@@ -453,6 +453,8 @@ enum {
 
 #define MBOX_TOUT_MS 100
 
+#define IPA_RULE_CNT_MAX 512
+
 /* miscellaneous for rmnet_ipa and qmi_service */
 enum ipa_type_mode {
 	IPA_HW_TYPE,

+ 4 - 1
drivers/platform/msm/ipa/ipa_v3/ipa_rt.c

@@ -1097,7 +1097,10 @@ static int __ipa_finish_rt_rule_add(struct ipa3_rt_entry *entry, u32 *rule_hdl,
 {
 	int id;
 
-	tbl->rule_cnt++;
+	if (tbl->rule_cnt < IPA_RULE_CNT_MAX)
+		tbl->rule_cnt++;
+	else
+		return -EINVAL;
 	if (entry->hdr)
 		entry->hdr->ref_cnt++;
 	else if (entry->proc_ctx)