evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: rmnet_ipa: fix security issue

Browse source 
Fix the security issue where mux channel name might
not be null-terminated in ipa wan driver.

Change-Id: I3ef440b62cf3861464fb60c1e7f65f2be5e39ed0
Acked-by: Shihuan Liu <shihuanl@qti.qualcomm.com>
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
This commit is contained in:
Skylar Chang 2017-04-14 19:23:05 -07:00 • committed by Shihuan Liu
parent 4e6f40f24c
commit 021b9a458c
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c
View file

@ -1542,6 +1542,9 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
memcpy(mux_channel[rmnet_index].vchannel_name,
extend_ioctl_data.u.rmnet_mux_val.vchannel_name,
sizeof(mux_channel[rmnet_index].vchannel_name));
mux_channel[rmnet_index].vchannel_name[
IFNAMSIZ - 1] = '\0';
IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n",
mux_channel[rmnet_index].vchannel_name,
mux_channel[rmnet_index].mux_id,

3
drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c
View file

@ -1663,6 +1663,9 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
extend_ioctl_data.u.rmnet_mux_val.vchannel_name,
sizeof(mux_channel[rmnet_index]
.vchannel_name));
mux_channel[rmnet_index].vchannel_name[
IFNAMSIZ - 1] = '\0';
IPAWANDBG("cashe device[%s:%d] in IPA_wan[%d]\n",
mux_channel[rmnet_index].vchannel_name,
mux_channel[rmnet_index].mux_id,