From cf0602ada58b1834ac430bef478657880c0a12b1 Mon Sep 17 00:00:00 2001 From: Sarannya S Date: Wed, 28 Dec 2022 17:28:53 +0530 Subject: [PATCH] net: qrtr: haven: Add bounds check on tx path Add bounds check on values read from shared memory in the tx path. In cases where the VM is misbehaving, the qrtr haven transport should exit and print a warning when bogus values may cause out of bounds to be read. Change-Id: Ic1177ced6f41de66459970eff4537d82de4f614e Signed-off-by: Sarannya S --- net/qrtr/haven.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/qrtr/haven.c b/net/qrtr/haven.c index b37e779c7e7f..02719209782f 100644 --- a/net/qrtr/haven.c +++ b/net/qrtr/haven.c @@ -188,6 +188,9 @@ static size_t haven_tx_avail(struct haven_pipe *pipe) else avail -= FIFO_FULL_RESERVE; + if (WARN_ON_ONCE(avail > pipe->length)) + avail = 0; + return avail; } @@ -198,6 +201,8 @@ static void haven_tx_write(struct haven_pipe *pipe, u32 head; head = le32_to_cpu(*pipe->head); + if (WARN_ON_ONCE(head > pipe->length)) + return; len = min_t(size_t, count, pipe->length - head); if (len)