Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3014b508 authored by Arun Kumar Neelakantam's avatar Arun Kumar Neelakantam Committed by Gerrit - the friendly Code Review server
Browse files

net: ipc_router: Fix buffer overflow during memcpy 



The increment logic of u64 pointer in skb_copy_to_log_buf() leads to
buffer overflow.

Modify the proto type of skb_copy_to_log_buf() function to accept
only unsigned char pointer.

CRs-Fixed: 2212592
Change-Id: I8affff1316656c1060ec57f2fb10b46f85314358
Signed-off-by: default avatarArun Kumar Neelakantam <aneela@codeaurora.org>
parent 021aa411

net/ipc_router/ipc_router_core.c

+4 −3
Original line number Diff line number Diff line 
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2011-2016, 2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -269,7 +269,7 @@ static uint32_t ipc_router_calc_checksum(union rr_control_msg *msg) 
 */

static void skb_copy_to_log_buf(struct sk_buff_head *skb_head,

				unsigned int pl_len, unsigned int hdr_offset,

				uint64_t *log_buf)

				unsigned char *log_buf)

{

	struct sk_buff *temp_skb;

	unsigned int copied_len = 0, copy_len = 0;
@@ -349,7 +349,8 @@ static void ipc_router_log_msg(void *log_ctx, uint32_t xchng_type, 
			else if (hdr->version == IPC_ROUTER_V2)

				hdr_offset = sizeof(struct rr_header_v2);

		}

		skb_copy_to_log_buf(skb_head, buf_len, hdr_offset, &pl_buf);

		skb_copy_to_log_buf(skb_head, buf_len, hdr_offset,

				    (unsigned char *)&pl_buf);



		if (port_ptr && rport_ptr && (port_ptr->type == CLIENT_PORT)

				&& (rport_ptr->server != NULL)) {