From ad457d24131a34d110ab1afd515975e15deb70d0 Mon Sep 17 00:00:00 2001 From: Sarannya S Date: Wed, 28 Dec 2022 11:12:04 +0530 Subject: [PATCH] net: ipc_router: Add bounds check on tx path Add bounds check on values read from shared memory in the tx path. In cases where the VM is misbehaving, the ipcrtr fifo xport should exit and print a warning when bogus values may cause out of bounds to be read. Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d Signed-off-by: Sarannya S --- net/ipc_router/ipc_router_fifo_xprt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipc_router/ipc_router_fifo_xprt.c b/net/ipc_router/ipc_router_fifo_xprt.c index c90534dac923..d55c5ab8926f 100644 --- a/net/ipc_router/ipc_router_fifo_xprt.c +++ b/net/ipc_router/ipc_router_fifo_xprt.c @@ -129,6 +129,9 @@ static size_t fifo_tx_avail(struct msm_ipc_pipe *pipe) else avail = tail - head; + if (WARN_ON_ONCE(avail > pipe->length)) + avail = 0; + return avail; } @@ -139,6 +142,8 @@ static void fifo_tx_write(struct msm_ipc_pipe *pipe, u32 head; head = le32_to_cpu(*pipe->head); + if (WARN_ON_ONCE(head > pipe->length)) + return; len = min_t(size_t, count, pipe->length - head); if (len)