asgardius/android_kernel_motorola_sm6225
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ipa: Fix array out of bound and use after NULL check

Browse source 
Couple of code cleanup
 - Check for upper boundary for resource_index
   not to dependent on ipa_rm_dep_get_index function.
 - Check actual argument for NULL and return.

Change-Id: I0ab244e68d96f7841ab2a10e61f2546314166165
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
This commit is contained in:
Mohammed Javid 2017-11-09 15:16:46 +05:30 committed by Swetha Chikkaboraiah
parent c87f188c26
commit 7e04ab0ab1
2 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/platform/msm/ipa/ipa_rm_dependency_graph.c
View file

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
* Copyright (c) 2013-2018, 2021, The Linux Foundation. All rights reserved.
*/
#include <linux/slab.h>
@ -77,7 +77,8 @@ int ipa_rm_dep_graph_get_resource(
goto bail;
}
resource_index = ipa_rm_dep_get_index(resource_name);
if (resource_index == IPA_RM_INDEX_INVALID) {
if (resource_index == IPA_RM_INDEX_INVALID ||
resource_index >= IPA_RM_RESOURCE_MAX) {
result = -EINVAL;
goto bail;
}
@ -109,7 +110,8 @@ int ipa_rm_dep_graph_add(struct ipa_rm_dep_graph *graph,
goto bail;
}
resource_index = ipa_rm_dep_get_index(resource->name);
if (resource_index == IPA_RM_INDEX_INVALID) {
if (resource_index == IPA_RM_INDEX_INVALID ||
resource_index >= IPA_RM_RESOURCE_MAX) {
result = -EINVAL;
goto bail;
}

8
drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c
View file

@ -2870,7 +2870,13 @@ static int rmnet_ipa_query_tethering_stats_modem(
IPAWANDBG("reset the pipe stats\n");
} else {
/* print tethered-client enum */
IPAWANDBG_LOW("Tethered-client enum(%d)\n", data->ipa_client);
if (data == NULL) {
kfree(req);
kfree(resp);
return -EINVAL;
}
IPAWANDBG_LOW("Tethered-client enum(%d)\n",
data->ipa_client);
}
rc = ipa_qmi_get_data_stats(req, resp);