evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: ipa3: Fix to validate the user inputs"

Browse source
This commit is contained in:
Linux Build Service Account 2018-10-30 11:23:44 -07:00 • committed by Gerrit - the friendly Code Review server
commit d9048f0016
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/platform/msm/ipa/ipa_v2/ipa_nat.c
View file

@ -35,6 +35,13 @@ enum nat_table_type {
#define NAT_TABLE_ENTRY_SIZE_BYTE 32
#define NAT_INTEX_TABLE_ENTRY_SIZE_BYTE 4
/*
* Max NAT table entries is limited 1000 entries.
* Limit the memory size required by user to prevent kernel memory starvation
*/
#define IPA_TABLE_MAX_ENTRIES 1000
#define MAX_ALLOC_NAT_SIZE (IPA_TABLE_MAX_ENTRIES * NAT_TABLE_ENTRY_SIZE_BYTE)
static int ipa_nat_vma_fault_remap(
struct vm_area_struct *vma, struct vm_fault *vmf)
{
@ -270,6 +277,13 @@ int ipa2_allocate_nat_device(struct ipa_ioc_nat_alloc_mem *mem)
goto bail;
}
if (mem->size > MAX_ALLOC_NAT_SIZE) {
IPAERR("Trying allocate more size = %zu, Max allowed = %d\n",
mem->size, MAX_ALLOC_NAT_SIZE);
result = -EPERM;
goto bail;
}
if (mem->size <= 0 ||
nat_ctx->is_dev_init == true) {
IPAERR_RL("Invalid Parameters or device is already init\n");

14
drivers/platform/msm/ipa/ipa_v3/ipa_nat.c
View file

@ -34,6 +34,13 @@ enum nat_table_type {
#define NAT_TABLE_ENTRY_SIZE_BYTE 32
#define NAT_INTEX_TABLE_ENTRY_SIZE_BYTE 4
/*
* Max NAT table entries is limited 1000 entries.
* Limit the memory size required by user to prevent kernel memory starvation
*/
#define IPA_TABLE_MAX_ENTRIES 1000
#define MAX_ALLOC_NAT_SIZE (IPA_TABLE_MAX_ENTRIES * NAT_TABLE_ENTRY_SIZE_BYTE)
static int ipa3_nat_vma_fault_remap(
struct vm_area_struct *vma, struct vm_fault *vmf)
{
@ -272,6 +279,13 @@ int ipa3_allocate_nat_device(struct ipa_ioc_nat_alloc_mem *mem)
goto bail;
}
if (mem->size > MAX_ALLOC_NAT_SIZE) {
IPAERR("Trying allocate more size = %zu, Max allowed = %d\n",
mem->size, MAX_ALLOC_NAT_SIZE);
result = -EPERM;
goto bail;
}
if (mem->size <= 0 ||
nat_ctx->is_dev_init == true) {
IPAERR_RL("Invalid Parameters or device is already init\n");