From ca1c9dc6bfb5acda92857862b0704cacc612c527 Mon Sep 17 00:00:00 2001 From: Chris Lew Date: Wed, 11 Nov 2020 17:57:45 -0800 Subject: [PATCH] net: neuron: channel: Check buffer boundaries Sanitize the ring buffer length read from the other side to ensure the bounds match the memory that is mapped. Change-Id: Ifdac3e0dee11374e61ede3a2cfb82e1957c6a2b2 Signed-off-by: Chris Lew --- net/neuron/channel/ch_haven_send.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/neuron/channel/ch_haven_send.c b/net/neuron/channel/ch_haven_send.c index 7947be558dce..37ab21e15495 100644 --- a/net/neuron/channel/ch_haven_send.c +++ b/net/neuron/channel/ch_haven_send.c @@ -180,6 +180,8 @@ static int read_config(struct neuron_mq_data_priv *priv) msgq->message_alignment = hdr->message_alignment; /* Get ring_buffer_len value. */ msgq->ring_buffer_len = hdr->ring_buffer_len; + if (msgq->ring_buffer_len > resource_size(&priv->buffer)) + return -ECONNRESET; /* Get tail_offset, making sure the value is valid. */ offset = hdr->tail_offset; if (offset > resource_size(&priv->buffer))