joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

net: ipc_router: Add bounds check on tx path

Browse source 
Add bounds check on values read from shared memory in the tx path.
In cases where the VM is misbehaving, the ipcrtr fifo xport should
exit and print a warning when bogus values may cause out of bounds to
be read.

Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
(cherry picked from commit ab670cc7990f6df627e1edeb03937d9e7863dd7b)
This commit is contained in:
Sarannya S 2022-12-28 11:12:04 +05:30
commit 5fa88d2e2f
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
net/ipc_router/ipc_router_fifo_xprt.c
View file

@ -129,6 +129,9 @@ static size_t fifo_tx_avail(struct msm_ipc_pipe *pipe)
else
avail = tail - head;
if (WARN_ON_ONCE(avail > pipe->length))
avail = 0;
return avail;
}
@ -139,6 +142,8 @@ static void fifo_tx_write(struct msm_ipc_pipe *pipe,
u32 head;
head = le32_to_cpu(*pipe->head);
if (WARN_ON_ONCE(head > pipe->length))
return;
len = min_t(size_t, count, pipe->length - head);
if (len)