lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: ipa: Fix string out of bound issue.

Browse Source 
Currently during RMNET_IOCTL_GET_MTU and RMNET_IOCTL_SET_MTU ioctls
we can recieve not null terminated string for if_name which was
resulting in string out of bound error while accessing the if_name.
Now adding null character at the end of string to prevent access
beyond its size.

Change-Id: I4d82a4b491f04a85d6ab4f0211671520156f7c61
Signed-off-by: Piyush Dhyani <pdhyani@codeaurora.org>
This commit is contained in:
Piyush Dhyani 2021-01-05 12:15:32 +05:30
parent 9ba94188f5
commit b26c6609c2
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c
View File

@ -2095,6 +2095,8 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
/* Get MTU */
case RMNET_IOCTL_GET_MTU:
mux_channel = rmnet_ipa3_ctx->mux_channel;
ext_ioctl_data.u.mtu_params.if_name
[IFNAMSIZ-1] = '\0';
rmnet_index =
find_vchannel_name_index(ext_ioctl_data.u.mtu_params.if_name);
@ -2115,6 +2117,8 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
/* Set MTU */
case RMNET_IOCTL_SET_MTU:
mux_channel = rmnet_ipa3_ctx->mux_channel;
ext_ioctl_data.u.mtu_params.if_name
[IFNAMSIZ-1] = '\0';
rmnet_index =
find_vchannel_name_index(ext_ioctl_data.u.mtu_params.if_name);