Merge "net: ipc_router: Validate return from skb_peek" (bd6ee3b5) · Commits · e / devices / android_kernel_xiaomi_markw

net/ipc_router/ipc_router_core.c

+11 −1

Original line number	Diff line number	Diff line
		@@ -2924,6 +2924,10 @@ static int loopback_data(struct msm_ipc_port *src,
		}

		temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
		if (!temp_skb) {
		IPC_RTR_ERR("%s: Empty skb\n", __func__);
		return -EINVAL;
		}
		align_size = ALIGN_SIZE(pkt->length);
		skb_put(temp_skb, align_size);
		pkt->length += align_size;
		@@ -3085,6 +3089,11 @@ static int msm_ipc_router_write_pkt(struct msm_ipc_port *src,
		}

		temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
		if (!temp_skb) {
		IPC_RTR_ERR("%s: Abort invalid pkt\n", __func__);
		ret = -EINVAL;
		goto out_write_pkt;
		}
		align_size = ALIGN_SIZE(pkt->length);
		skb_put(temp_skb, align_size);
		pkt->length += align_size;
		@@ -3412,6 +3421,7 @@ int msm_ipc_router_recv_from(struct msm_ipc_port *port_ptr,
		align_size = ALIGN_SIZE(data_len);
		if (align_size) {
		temp_skb = skb_peek_tail((*pkt)->pkt_fragment_q);
		if (temp_skb)
		skb_trim(temp_skb, (temp_skb->len - align_size));
		}
		return data_len;

+5 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -150,6 +150,10 @@ static int msm_ipc_router_extract_msg(struct msghdr *m,
		hdr = &(pkt->hdr);
		if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_RESUME_TX)) {
		temp = skb_peek(pkt->pkt_fragment_q);
		if (!temp \|\| !temp->data) {
		IPC_RTR_ERR("%s: Invalid skb\n", __func__);
		return -EINVAL;
		}
		ctl_msg = (union rr_control_msg *)(temp->data);
		addr->family = AF_MSM_IPC;
		addr->address.addrtype = MSM_IPC_ADDR_ID;