joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

net: ipc_router: Validate return from skb_peek

Browse source 
The skb_peek and skb_peek_tail functions can return NULL if the skb
list is empty. Check the return value before using the skb.

CRs-Fixed: 2121368
Change-Id: If14320104ec37b8b7504e930ed8fd06e72d08724
Signed-off-by: Chris Lew <clew@codeaurora.org>
This commit is contained in:
Chris Lew 2017-10-04 15:58:16 -07:00
commit 42ea961483
2 changed files with 16 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
net/ipc_router/ipc_router_core.c
View file

@ -2925,6 +2925,10 @@ static int loopback_data(struct msm_ipc_port *src,
}
temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
if (!temp_skb) {
IPC_RTR_ERR("%s: Empty skb\n", __func__);
return -EINVAL;
}
align_size = ALIGN_SIZE(pkt->length);
skb_put(temp_skb, align_size);
pkt->length += align_size;
@ -3089,6 +3093,11 @@ msm_ipc_router_write_pkt(struct msm_ipc_port *src,
}
temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
if (!temp_skb) {
IPC_RTR_ERR("%s: Abort invalid pkt\n", __func__);
ret = -EINVAL;
goto out_write_pkt;
}
align_size = ALIGN_SIZE(pkt->length);
skb_put(temp_skb, align_size);
pkt->length += align_size;
@ -3408,7 +3417,8 @@ int msm_ipc_router_recv_from(struct msm_ipc_port *port_ptr,
align_size = ALIGN_SIZE(data_len);
if (align_size) {
temp_skb = skb_peek_tail((*pkt)->pkt_fragment_q);
skb_trim(temp_skb, (temp_skb->len - align_size));
if (temp_skb)
skb_trim(temp_skb, (temp_skb->len - align_size));
}
return data_len;
}

6
net/ipc_router/ipc_router_socket.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -141,6 +141,10 @@ static int msm_ipc_router_extract_msg(struct msghdr *m,
hdr = &pkt->hdr;
if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_RESUME_TX)) {
temp = skb_peek(pkt->pkt_fragment_q);
if (!temp || !temp->data) {
IPC_RTR_ERR("%s: Invalid skb\n", __func__);
return -EINVAL;
}
ctl_msg = (union rr_control_msg *)(temp->data);
addr->family = AF_MSM_IPC;
addr->address.addrtype = MSM_IPC_ADDR_ID;