korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2025-01-20 04:44:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'pa-fox-validation'

Browse Source 
Alex Elder says:

====================
ipa: fix validation

There is sanity checking code in the IPA driver that's meant to be
enabled only during development.  This allows the driver to make
certain assumptions, but not have to verify those assumptions are
true at (operational) runtime.  This code is built conditional on
IPA_VALIDATION, set (if desired) inside the IPA makefile.

Unfortunately, this validation code has some errors.  First, there
are some mismatched arguments supplied to some dev_err() calls in
ipa_cmd_table_valid() and ipa_cmd_header_valid(), and these are
exposed if validation is enabled.  Second, the tag that enables
this conditional code isn't used consistently (it's IPA_VALIDATE
in some spots and IPA_VALIDATION in others).

This series fixes those two problems with the conditional validation
code.

Version 2 removes the two patches that introduced ipa_assert().  It
also modifies the description in the first patch so that it mentions
the changes made to ipa_cmd_table_valid().
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2021-03-20 18:53:41 -07:00
commit a05b0c8c82
1 changed files with 33 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
drivers/net/ipa/ipa_cmd.c
View File

@ -175,21 +175,23 @@ bool ipa_cmd_table_valid(struct ipa *ipa, const struct ipa_mem *mem,
: field_max(IP_FLTRT_FLAGS_NHASH_ADDR_FMASK);
if (mem->offset > offset_max ||
ipa->mem_offset > offset_max - mem->offset) {
dev_err(dev, "IPv%c %s%s table region offset too large "
"(0x%04x + 0x%04x > 0x%04x)\n",
ipv6 ? '6' : '4', hashed ? "hashed " : "",
route ? "route" : "filter",
ipa->mem_offset, mem->offset, offset_max);
dev_err(dev, "IPv%c %s%s table region offset too large\n",
ipv6 ? '6' : '4', hashed ? "hashed " : "",
route ? "route" : "filter");
dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
ipa->mem_offset, mem->offset, offset_max);
return false;
}
if (mem->offset > ipa->mem_size ||
mem->size > ipa->mem_size - mem->offset) {
dev_err(dev, "IPv%c %s%s table region out of range "
"(0x%04x + 0x%04x > 0x%04x)\n",
ipv6 ? '6' : '4', hashed ? "hashed " : "",
route ? "route" : "filter",
mem->offset, mem->size, ipa->mem_size);
dev_err(dev, "IPv%c %s%s table region out of range\n",
ipv6 ? '6' : '4', hashed ? "hashed " : "",
route ? "route" : "filter");
dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
mem->offset, mem->size, ipa->mem_size);
return false;
}
@ -205,22 +207,36 @@ static bool ipa_cmd_header_valid(struct ipa *ipa)
u32 size_max;
u32 size;
/* In ipa_cmd_hdr_init_local_add() we record the offset and size
* of the header table memory area. Make sure the offset and size
* fit in the fields that need to hold them, and that the entire
* range is within the overall IPA memory range.
*/
offset_max = field_max(HDR_INIT_LOCAL_FLAGS_HDR_ADDR_FMASK);
if (mem->offset > offset_max ||
ipa->mem_offset > offset_max - mem->offset) {
dev_err(dev, "header table region offset too large "
"(0x%04x + 0x%04x > 0x%04x)\n",
ipa->mem_offset + mem->offset, offset_max);
dev_err(dev, "header table region offset too large\n");
dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
ipa->mem_offset, mem->offset, offset_max);
return false;
}
size_max = field_max(HDR_INIT_LOCAL_FLAGS_TABLE_SIZE_FMASK);
size = ipa->mem[IPA_MEM_MODEM_HEADER].size;
size += ipa->mem[IPA_MEM_AP_HEADER].size;
if (mem->offset > ipa->mem_size || size > ipa->mem_size - mem->offset) {
dev_err(dev, "header table region out of range "
"(0x%04x + 0x%04x > 0x%04x)\n",
mem->offset, size, ipa->mem_size);
if (size > size_max) {
dev_err(dev, "header table region size too large\n");
dev_err(dev, " (0x%04x > 0x%08x)\n", size, size_max);
return false;
}
if (size > ipa->mem_size || mem->offset > ipa->mem_size - size) {
dev_err(dev, "header table region out of range\n");
dev_err(dev, " (0x%04x + 0x%04x > 0x%04x)\n",
mem->offset, size, ipa->mem_size);
return false;
}