Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 90a9da2e authored Dec 29, 2015 by Skylar Chang

msm: ipa: fix the mux_channel buffer overflow



Add the check on ipa wan-driver to check if
receiving more than MAX_NUM_OF_MUX_CHANNEL times
different RMNET_IOCTL_ADD_MUX_CHANNEL ioctls
from netmgrd.

CRs-Fixed: 956393
Change-Id: Ic8890b084a8da69fdcf54541e82f6e4961492ce1
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>

parent bf1f2607

drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c

+6 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -1366,6 +1366,11 @@ static int ipa_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		rmnet_mux_val.mux_id);
		return rc;
		}
		if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
		IPAWANERR("Exceed mux_channel limit(%d)\n",
		rmnet_index);
		return -EFAULT;
		}
		IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
		extend_ioctl_data.u.rmnet_mux_val.mux_id,
		extend_ioctl_data.u.rmnet_mux_val.vchannel_name);

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1382,6 +1382,12 @@ static int ipa3_wwan_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
		rmnet_mux_val.mux_id);
		return rc;
		}
		if (rmnet_ipa3_ctx->rmnet_index
		>= MAX_NUM_OF_MUX_CHANNEL) {
		IPAWANERR("Exceed mux_channel limit(%d)\n",
		rmnet_ipa3_ctx->rmnet_index);
		return -EFAULT;
		}
		IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
		extend_ioctl_data.u.rmnet_mux_val.mux_id,
		extend_ioctl_data.u.rmnet_mux_val.vchannel_name);