A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

rpmsg: validate incoming message length before propagating

Browse source 
When an inbound message arrives, validate its reported length before
propagating it, otherwise buggy (or malicious) remote processors might
trick us into accessing memory which we really shouldn't.

Signed-off-by: Ohad Ben-Cohen <[email protected]>
Cc: Grant Likely <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Mark Grosen <[email protected]>
Cc: Suman Anna <[email protected]>
Cc: Fernando Guzman Lugo <[email protected]>
Cc: Rob Clark <[email protected]>
Cc: Ludovic BARRE <[email protected]>
Cc: Loic PALLARDY <[email protected]>
Cc: Omar Ramirez Luna <[email protected]>
This commit is contained in:
Ohad Ben-Cohen 2012-02-28 16:16:48 +02:00
commit 9648224e56
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/rpmsg/virtio_rpmsg_bus.c
View file

@ -778,6 +778,16 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
print_hex_dump(KERN_DEBUG, "rpmsg_virtio RX: ", DUMP_PREFIX_NONE, 16, 1,
msg, sizeof(*msg) + msg->len, true);
/*
* We currently use fixed-sized buffers, so trivially sanitize
* the reported payload length.
*/
if (len > RPMSG_BUF_SIZE ||
msg->len > (len - sizeof(struct rpmsg_hdr))) {
dev_warn(dev, "inbound msg too big: (%d, %d)\n", len, msg->len);
return;
}
/* use the dst addr to fetch the callback of the appropriate user */
mutex_lock(&vrp->endpoints_lock);
ept = idr_find(&vrp->endpoints, msg->dst);