From 2bd90484198b89199dfd05d92552164829f28bb7 Mon Sep 17 00:00:00 2001
From: Skylar Chang <chiaweic@codeaurora.org>
Date: Tue, 29 Dec 2015 18:50:34 -0800
Subject: [PATCH] msm: ipa: fix the mux_channel buffer overflow
Add the check on ipa wan-driver to check if
receiving more than MAX_NUM_OF_MUX_CHANNEL times
different RMNET_IOCTL_ADD_MUX_CHANNEL ioctls
from netmgrd.
CRs-Fixed: 956393
Change-Id: Ic8890b084a8da69fdcf54541e82f6e4961492ce1
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
---
drivers/platform/msm/ipa/rmnet_ipa.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/platform/msm/ipa/rmnet_ipa.c b/drivers/platform/msm/ipa/rmnet_ipa.c
index 5d02833cc2ef..ba48b94cb371 100644
--- a/drivers/platform/msm/ipa/rmnet_ipa.c
+++ b/drivers/platform/msm/ipa/rmnet_ipa.c
@@ -1175,6 +1175,11 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
rmnet_mux_val.mux_id);
return rc;
}
+ if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
+ IPAWANERR("Exceed mux_channel limit(%d)\n",
+ rmnet_index);
+ return -EFAULT;
+ }
IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
extend_ioctl_data.u.rmnet_mux_val.mux_id,
extend_ioctl_data.u.rmnet_mux_val.vchannel_name);
--
GitLab