msm: ipa: fix the mux_channel buffer overflow

Add the check on ipa wan-driver to check if
receiving more than MAX_NUM_OF_MUX_CHANNEL times
different RMNET_IOCTL_ADD_MUX_CHANNEL ioctls
from netmgrd.

CRs-Fixed: 956393
Change-Id: Ic8890b084a8da69fdcf54541e82f6e4961492ce1
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>

drivers/platform/msm/ipa/rmnet_ipa.c

@@ -1175,6 +1175,11 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 					rmnet_mux_val.mux_id);
 				return rc;
 			}
+			if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
+				IPAWANERR("Exceed mux_channel limit(%d)\n",
+				rmnet_index);
+				return -EFAULT;
+			}
 			IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
 			extend_ioctl_data.u.rmnet_mux_val.mux_id,
 			extend_ioctl_data.u.rmnet_mux_val.vchannel_name);