tree 07a41dedb62df30a09dab59c82ddd10b166f8066
parent f8037c1f425463c51a2a3b6f09021b1b2a224abb
author Skylar Chang <chiaweic@codeaurora.org> 1488413307 -0800
committer Nick Desaulniers <ndesaulniers@google.com> 1491864911 +0000

FROMLIST: msm: IPA: add the check on intf query

The ipa_ioc_query_intf_rx_props structure comes
from the ioctl handler, and it is verified that
the size of rx buffer does not exceed the
IPA_NUM_PROPS_MAX elements. It is also verified
that the "entry->rx" buffer does not exceed
IPA_NUM_PROPS_MAX when "entry" is allocated.
However, the sizes of the buffer "rx->rx" and
the buffer "entry->rx" are not guaranteed to
be the same and will lead memory corruption
issue. The fix is to add the check before
memcpy.

Bug: 34026243
Bug: 35048450
Bug: 35047780
Bug: 35047217
Change-Id: Idf5c2d32f47c1a1cffeaa5607193855188893ddb
Signed-off-by: Skylar Chang <chiaweic@codeaurora.org>
Signed-off-by: Steve Pfetsch <spfetsch@google.com>
(am from https://source.codeaurora.org/quic/la/kernel/
msm-3.18/commit/?id=cf0d31bc3b04cf2db7737d36b11a5bf50af0c1db)