xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32

Browse Source 
rmnet_rtnl_validate() was checking for upto mux_id 254, however the
rmnet_devices devices could hold upto 32 entries only. Fix this by
increasing the size of the rmnet_devices.

Fixes: ceed73a2cf ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Dan Williams <dcbw@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Subash Abhinov Kasiviswanathan
2017-09-02 23:30:41 -06:00
committed by David S. Miller
parent 3cf2e08f5a
commit 009e1b2b7a
3 changed files with 2 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
View File

@@ -19,7 +19,6 @@
#define _RMNET_CONFIG_H_
#define RMNET_MAX_LOGICAL_EP 255
#define RMNET_MAX_VND 32
/* Information about the next device to deliver the packet to.
* Exact usage of this parameter depends on the rmnet_mode.
@@ -39,7 +38,7 @@ struct rmnet_real_dev_info {
struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];
u32 ingress_data_format;
u32 egress_data_format;
struct net_device *rmnet_devices[RMNET_MAX_VND];
struct net_device *rmnet_devices[RMNET_MAX_LOGICAL_EP];
u8 nr_rmnet_devs;
};

1
drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
View File

@@ -13,7 +13,6 @@
#ifndef _RMNET_PRIVATE_H_
#define _RMNET_PRIVATE_H_
#define RMNET_MAX_VND 32
#define RMNET_MAX_PACKET_SIZE 16384
#define RMNET_DFLT_PACKET_SIZE 1500
#define RMNET_NEEDED_HEADROOM 16

2
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
View File

@@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)
{
if (id >= RMNET_MAX_VND || !r->rmnet_devices[id])
if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id])
return -EINVAL;
r->rmnet_devices[id] = NULL;