R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

msm: ipa: Fix pointer checked for NULL may be used

Browse Source 
Data pointer may be NULL, check for reset value
to be false in that case and return EINVAL for
invalid argument.

Change-Id: I05a4aa96724c123516a7965bd0e939bdf0c86553
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
This commit is contained in:
Mohammed Javid 2017-10-26 15:14:39 +05:30 committed by Swetha Chikkaboraiah
parent 1bccccb42e
commit e8755fbb19
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c
View File

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2014-2018, 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2014-2018, 2020-2021, The Linux Foundation. All rights reserved.
*/
/*
@ -2837,6 +2837,15 @@ static int rmnet_ipa_query_tethering_stats_modem(
struct ipa_get_data_stats_resp_msg_v01 *resp;
int pipe_len, rc;
if (data != NULL) {
/* prevent string buffer overflows */
data->upstreamIface[IFNAMSIZ-1] = '\0';
data->tetherIface[IFNAMSIZ-1] = '\0';
} else if (reset) {
/* Data can be NULL for reset stats, checking reset != False */
return -EINVAL;
}
req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),
GFP_KERNEL);
if (!req) {

11
drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c
View File

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2014-2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2014-2021, The Linux Foundation. All rights reserved.
*/
/*
@ -3268,6 +3268,15 @@ static int rmnet_ipa3_query_tethering_stats_modem(
int pipe_len, rc;
struct ipa_pipe_stats_info_type_v01 *stat_ptr;
if (data != NULL) {
/* prevent string buffer overflows */
data->upstreamIface[IFNAMSIZ-1] = '\0';
data->tetherIface[IFNAMSIZ-1] = '\0';
} else if (reset) {
/* Data can be NULL for reset stats, checking reset != False */
return -EINVAL;
}
req = kzalloc(sizeof(struct ipa_get_data_stats_req_msg_v01),
GFP_KERNEL);
if (!req)