Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d15b66fd authored by Chaitanya Pratapa's avatar Chaitanya Pratapa Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: fix to validate the ioctl WAN_IOC_SEND_LAN_CLIENT_MSG params 



When processing WAN_IOC_SEND_LAN_CLIENT_MSG ioctl there is a possibility
of message_type being invalid and this can lead to out of buffer error.
Make a change to validate the ioctl params before processing.

Change-Id: If7955f77863b772ae1c8feda5ca0145c822403b9
Signed-off-by: default avatarChaitanya Pratapa <cpratapa@codeaurora.org>
parent 99638f95

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+9 −0
Original line number Original line Diff line number Diff line
@@ -4069,6 +4069,15 @@ int rmnet_ipa3_send_lan_client_msg( 
		IPAWANERR("Can't allocate memory for tether_info\n");

		IPAWANERR("Can't allocate memory for tether_info\n");

		return -ENOMEM;

		return -ENOMEM;

	}

	}



	if (data->client_event != IPA_PER_CLIENT_STATS_CONNECT_EVENT &&

		data->client_event != IPA_PER_CLIENT_STATS_DISCONNECT_EVENT) {

		IPAWANERR("Wrong event given. Event:- %d\n",

			data->client_event);

		kfree(lan_client);

		return -EINVAL;

	}

	data->lan_client.lanIface[IPA_RESOURCE_NAME_MAX-1] = '\0';

	memset(&msg_meta, 0, sizeof(struct ipa_msg_meta));

	memset(&msg_meta, 0, sizeof(struct ipa_msg_meta));

	memcpy(lan_client, &data->lan_client,

	memcpy(lan_client, &data->lan_client,

		sizeof(struct ipa_lan_client_msg));

		sizeof(struct ipa_lan_client_msg));