Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 009e1b2b authored by Subash Abhinov Kasiviswanathan's avatar Subash Abhinov Kasiviswanathan Committed by David S. Miller
Browse files

net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32 



rmnet_rtnl_validate() was checking for upto mux_id 254, however the
rmnet_devices devices could hold upto 32 entries only. Fix this by
increasing the size of the rmnet_devices.

Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Dan Williams <dcbw@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3cf2e08f

drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h

+1 −2
Original line number Original line Diff line number Diff line
@@ -19,7 +19,6 @@ 
#define _RMNET_CONFIG_H_

#define _RMNET_CONFIG_H_





#define RMNET_MAX_LOGICAL_EP 255

#define RMNET_MAX_LOGICAL_EP 255

#define RMNET_MAX_VND        32





/* Information about the next device to deliver the packet to.

/* Information about the next device to deliver the packet to.

 * Exact usage of this parameter depends on the rmnet_mode.

 * Exact usage of this parameter depends on the rmnet_mode.
@@ -39,7 +38,7 @@ struct rmnet_real_dev_info { 
	struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];

	struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];

	u32 ingress_data_format;

	u32 ingress_data_format;

	u32 egress_data_format;

	u32 egress_data_format;

	struct net_device *rmnet_devices[RMNET_MAX_VND];

	struct net_device *rmnet_devices[RMNET_MAX_LOGICAL_EP];

	u8 nr_rmnet_devs;

	u8 nr_rmnet_devs;

};

};

drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h

+0 −1
Original line number Original line Diff line number Diff line
@@ -13,7 +13,6 @@ 
#ifndef _RMNET_PRIVATE_H_

#ifndef _RMNET_PRIVATE_H_

#define _RMNET_PRIVATE_H_

#define _RMNET_PRIVATE_H_





#define RMNET_MAX_VND              32

#define RMNET_MAX_PACKET_SIZE      16384

#define RMNET_MAX_PACKET_SIZE      16384

#define RMNET_DFLT_PACKET_SIZE     1500

#define RMNET_DFLT_PACKET_SIZE     1500

#define RMNET_NEEDED_HEADROOM      16

#define RMNET_NEEDED_HEADROOM      16

drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, 




int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)

int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)

{

{

	if (id >= RMNET_MAX_VND || !r->rmnet_devices[id])

	if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id])

		return -EINVAL;

		return -EINVAL;





	r->rmnet_devices[id] = NULL;

	r->rmnet_devices[id] = NULL;