PWN-Hunter/android_kernel_xiaomi_sdm845
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: ipc_router: Add bounds check on tx path

Browse Source 
Add bounds check on values read from shared memory in the tx path.
In cases where the VM is misbehaving, the ipcrtr fifo xport should
exit and print a warning when bogus values may cause out of bounds to
be read.

Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
This commit is contained in:
Sarannya S 2022-12-28 11:12:04 +05:30 committed by Bruno Martins
parent fb5dd42ec9
commit c42a8750bc
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/ipc_router/ipc_router_fifo_xprt.c
View File

@ -129,6 +129,9 @@ static size_t fifo_tx_avail(struct msm_ipc_pipe *pipe)
else
avail = tail - head;
if (WARN_ON_ONCE(avail > pipe->length))
avail = 0;
return avail;
}
@ -139,6 +142,8 @@ static void fifo_tx_write(struct msm_ipc_pipe *pipe,
u32 head;
head = le32_to_cpu(*pipe->head);
if (WARN_ON_ONCE(head > pipe->length))
return;
len = min_t(size_t, count, pipe->length - head);
if (len)