Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba7c511c authored Apr 14, 2017 by Skylar Chang Committed by Shihuan Liu Apr 24, 2017

msm: rmnet_ipa: fix memory overflow issue



Fix the security issue where mux channel name might
not be null-terminated causing memory access overflow
in ipa wan driver.

Change-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0
Acked-by: Shihuan Liu <shihuanl@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>

parent 0a4d1ddb

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1541,6 +1541,9 @@ static int ipa_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		memcpy(mux_channel[rmnet_index].vchannel_name,
		extend_ioctl_data.u.rmnet_mux_val.vchannel_name,
		sizeof(mux_channel[rmnet_index].vchannel_name));
		mux_channel[rmnet_index].vchannel_name[
		IFNAMSIZ - 1] = '\0';

		IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n",
		mux_channel[rmnet_index].vchannel_name,
		mux_channel[rmnet_index].mux_id,

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1655,6 +1655,9 @@ static int ipa3_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		extend_ioctl_data.u.rmnet_mux_val.vchannel_name,
		sizeof(mux_channel[rmnet_index]
		.vchannel_name));
		mux_channel[rmnet_index].vchannel_name[
		IFNAMSIZ - 1] = '\0';

		IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n",
		mux_channel[rmnet_index].vchannel_name,
		mux_channel[rmnet_index].mux_id,