A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-26 06:33:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

net: neuron: channel: Check buffer boundaries

Browse source 
Sanitize the ring buffer length read from the other side to ensure
the bounds match the memory that is mapped.

Change-Id: Ifdac3e0dee11374e61ede3a2cfb82e1957c6a2b2
Signed-off-by: Chris Lew <clew@codeaurora.org>
This commit is contained in:
Chris Lew 2020-11-11 17:57:45 -08:00
commit ca1c9dc6bf
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
net/neuron/channel/ch_haven_send.c
View file

@ -180,6 +180,8 @@ static int read_config(struct neuron_mq_data_priv *priv)
msgq->message_alignment = hdr->message_alignment;
/* Get ring_buffer_len value. */
msgq->ring_buffer_len = hdr->ring_buffer_len;
if (msgq->ring_buffer_len > resource_size(&priv->buffer))
return -ECONNRESET;
/* Get tail_offset, making sure the value is valid. */
offset = hdr->tail_offset;
if (offset > resource_size(&priv->buffer))