msm: ipa: fix the mux_channel buffer overflow
Add the check on ipa wan-driver to check if
receiving more than MAX_NUM_OF_MUX_CHANNEL times
different RMNET_IOCTL_ADD_MUX_CHANNEL ioctls
from netmgrd.
Bug: 27316791
Change-Id: Id9dec134c8bf5772074367cc58610e76375401d9
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
Signed-off-by: Yuan Lin <yualin@google.com>
diff --git a/drivers/platform/msm/ipa/rmnet_ipa.c b/drivers/platform/msm/ipa/rmnet_ipa.c
index bedf69a..a149a9e 100644
--- a/drivers/platform/msm/ipa/rmnet_ipa.c
+++ b/drivers/platform/msm/ipa/rmnet_ipa.c
@@ -1242,6 +1242,11 @@
rmnet_mux_val.mux_id);
return rc;
}
+ if (rmnet_index >= MAX_NUM_OF_MUX_CHANNEL) {
+ IPAWANERR("Exceed mux_channel limit(%d)\n",
+ rmnet_index);
+ return -EFAULT;
+ }
IPAWANDBG("ADD_MUX_CHANNEL(%d, name: %s)\n",
extend_ioctl_data.u.rmnet_mux_val.mux_id,
extend_ioctl_data.u.rmnet_mux_val.vchannel_name);
