evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ipa: fix to validate the ioctl WAN_IOC_SEND_LAN_CLIENT_MSG params

Browse source 
When processing WAN_IOC_SEND_LAN_CLIENT_MSG ioctl there is a possibility
of message_type being invalid and this can lead to out of buffer error.
Make a change to validate the ioctl params before processing.

Change-Id: If7955f77863b772ae1c8feda5ca0145c822403b9
Signed-off-by: Chaitanya Pratapa <cpratapa@codeaurora.org>
This commit is contained in:
Chaitanya Pratapa 2019-02-26 15:06:31 +05:30 • committed by Gerrit - the friendly Code Review server
parent 2692bfe650
commit 7123fa1089
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c
View file

@ -3597,6 +3597,15 @@ int rmnet_ipa3_send_lan_client_msg(
IPAWANERR("Can't allocate memory for tether_info\n"); IPAWANERR("Can't allocate memory for tether_info\n");
return -ENOMEM; return -ENOMEM;
} }
if (data->client_event != IPA_PER_CLIENT_STATS_CONNECT_EVENT &&
data->client_event != IPA_PER_CLIENT_STATS_DISCONNECT_EVENT) {
IPAWANERR("Wrong event given. Event:- %d\n",
data->client_event);
kfree(lan_client);
return -EINVAL;
}
data->lan_client.lanIface[IPA_RESOURCE_NAME_MAX-1] = '\0';
memset(&msg_meta, 0, sizeof(struct ipa_msg_meta)); memset(&msg_meta, 0, sizeof(struct ipa_msg_meta));
memcpy(lan_client, &data->lan_client, memcpy(lan_client, &data->lan_client,
sizeof(struct ipa_lan_client_msg)); sizeof(struct ipa_lan_client_msg));