Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37fca029 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ipa: fix the mux_channel buffer overflow"

parents ad17e926 90a9da2e

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+6 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1366,6 +1366,11 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
					rmnet_mux_val.mux_id);

				return rc;

			}

			if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {

				IPAWANERR("Exceed mux_channel limit(%d)\n",

				rmnet_index);

				return -EFAULT;

			}

			IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",

			extend_ioctl_data.u.rmnet_mux_val.mux_id,

			extend_ioctl_data.u.rmnet_mux_val.vchannel_name);

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+6 −0
Original line number Diff line number Diff line
@@ -1382,6 +1382,12 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
					rmnet_mux_val.mux_id);

				return rc;

			}

			if (rmnet_ipa3_ctx->rmnet_index

				>= MAX_NUM_OF_MUX_CHANNEL) {

				IPAWANERR("Exceed mux_channel limit(%d)\n",

				rmnet_ipa3_ctx->rmnet_index);

				return -EFAULT;

			}

			IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",

			extend_ioctl_data.u.rmnet_mux_val.mux_id,

			extend_ioctl_data.u.rmnet_mux_val.vchannel_name);