Commit 1b790126 authored Sep 21, 2020 by Sean Tranchetti

rmnet_core: Pass correct size to skb_copy_bits



When copying the QMAP header during deaggregation, the size of the data
to copy was incorrectly passed to skb_copy_bits() as the size of the
pointer instead of the struct. This lead to copying more data onto the
stack than there was room for.

Change-Id: I19208a8df2d8ce25a22fff95b71f1c56dcddec89
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>

parent f2824c85

core/rmnet_descriptor.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -582,7 +582,7 @@ static int rmnet_frag_deaggregate_one(struct sk_buff *skb,
		* Probably not faster or stronger than before. But certainly
		* more linear.
		*/
		if (skb_copy_bits(skb, 0, &__maph, sizeof(&__maph)) < 0)
		if (skb_copy_bits(skb, 0, &__maph, sizeof(__maph)) < 0)
		return -1;

		maph = &__maph;