Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4e63563c authored by Skylar Chang's avatar Skylar Chang Committed by Shreyas Narayan
Browse files

msm: rmnet_ipa: fix memory overflow issue 



Fix the security issue where mux channel name might
not be null-terminated causing memory access overflow
in ipa wan driver.

Change-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0
Acked-by: default avatarShihuan Liu <shihuanl@qti.qualcomm.com>
Signed-off-by: default avatarSkylar Chang <chiaweic@codeaurora.org>
parent 0a15db61

drivers/platform/msm/ipa/rmnet_ipa.c

+3 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2014, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1236,6 +1236,8 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
			memcpy(mux_channel[rmnet_index].vchannel_name,

				extend_ioctl_data.u.rmnet_mux_val.vchannel_name,

				sizeof(mux_channel[rmnet_index].vchannel_name));

			mux_channel[rmnet_index].vchannel_name[

				IFNAMSIZ - 1] = '\0';

			IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n",

				mux_channel[rmnet_index].vchannel_name,

				mux_channel[rmnet_index].mux_id,