msm: ipa3: code security concern for IPA-QMI driver

Added checks for input validation to handle request from ipa3_wan_ioctl.

Change-Id: I4deddba21a4754ea3b5137b13ef5c450fdb3b73b
Signed-off-by: Himansu Nayak<[email protected]>

drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c

@@ -933,20 +933,39 @@ int ipa3_qmi_filter_request_ex_send(
 	if (req->filter_spec_ex_list_len == 0) {
 		IPAWANDBG("IPACM pass zero rules to Q6\n");
 	} else {
-		IPAWANDBG("IPACM pass %u rules to Q6\n",
-		req->filter_spec_ex_list_len);
+		IPAWANDBG(
+		"IPACM pass %u rule to Q6\n",req->filter_spec_ex_list_len);
 	}
-
-	if (req->filter_spec_ex_list_len >= QMI_IPA_MAX_FILTERS_EX_V01) {
+	if (req->filter_spec_ex_list_valid && req->filter_spec_ex_list_len >
+					QMI_IPA_MAX_FILTERS_EX_V01) {
 		IPAWANDBG(
 		"IPACM pass the number of filtering rules exceed limit\n");
 		return -EINVAL;
 	} else if (req->source_pipe_index_valid != 0) {
 		IPAWANDBG(
-		"IPACM passes source_pipe_index_valid not zero 0 != %d\n",
+		"IPACM passes source_pipe_index_valid not zero 0 !=%d\n",
 			req->source_pipe_index_valid);
 		return -EINVAL;
 	}
+	if (req->xlat_filter_indices_list_valid &&
+		(req->xlat_filter_indices_list_len >
+				QMI_IPA_MAX_FILTERS_EX_V01)) {
+		IPAWANDBG(
+		"IPACM pass the number of filtering rules exceed limit\n");
+		return -EINVAL;
+	}
+	if (req->filter_spec_ex2_list_valid &&
+		(req->filter_spec_ex2_list_len > QMI_IPA_MAX_FILTERS_V01)) {
+		IPAWANDBG(
+		"IPACM pass the number of filtering rules exceed limit\n");
+		return -EINVAL;
+	}
+	if (req->ul_firewall_indices_list_valid &&
+		(req->ul_firewall_indices_list_len > QMI_IPA_MAX_FILTERS_V01)) {
+		IPAWANDBG(
+		"IPACM pass the number of filtering rules exceed limit\n");
+		return -EINVAL;
+	}
 
 	for (i = 0; i < req->filter_spec_ex_list_len; i++) {
 		if ((req->filter_spec_ex_list[i].ip_type !=
@@ -978,7 +997,14 @@ int ipa3_qmi_filter_request_ex_send(
 	mutex_unlock(&ipa3_qmi_lock);
 
 	req_desc.max_msg_len = ipa3_qmi_filter_request_ex_calc_length(req);
-	IPAWANDBG("QMI send request length = %d\n", req_desc.max_msg_len);
+	if( req_desc.max_msg_len < 0 ){
+		IPAWANDBG(
+		"QMI send request length = %d\n", req_desc.max_msg_len);
+		return -EINVAL;
+	} else {
+		IPAWANDBG("QMI send request length = %d\n",
+		req_desc.max_msg_len);
+	}
 
 	req_desc.msg_id = QMI_IPA_INSTALL_FILTER_RULE_EX_REQ_V01;
 	req_desc.ei_array = ipa3_install_fltr_rule_req_ex_msg_data_v01_ei;