All of lore.kernel.org
 help / color / mirror / Atom feed
From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
To: netdev@vger.kernel.org, davem@davemloft.net
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>,
	Dan Williams <dcbw@redhat.com>
Subject: [PATCH net-next 1/6] net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32
Date: Sat,  2 Sep 2017 23:30:41 -0600	[thread overview]
Message-ID: <1504416646-9527-2-git-send-email-subashab@codeaurora.org> (raw)
In-Reply-To: <1504416646-9527-1-git-send-email-subashab@codeaurora.org>

rmnet_rtnl_validate() was checking for upto mux_id 254, however the
rmnet_devices devices could hold upto 32 entries only. Fix this by
increasing the size of the rmnet_devices.

Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Dan Williams <dcbw@redhat.com>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h  | 3 +--
 drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h | 1 -
 drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c     | 2 +-
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 985d372..40b6b32 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -19,7 +19,6 @@
 #define _RMNET_CONFIG_H_
 
 #define RMNET_MAX_LOGICAL_EP 255
-#define RMNET_MAX_VND        32
 
 /* Information about the next device to deliver the packet to.
  * Exact usage of this parameter depends on the rmnet_mode.
@@ -39,7 +38,7 @@ struct rmnet_real_dev_info {
 	struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];
 	u32 ingress_data_format;
 	u32 egress_data_format;
-	struct net_device *rmnet_devices[RMNET_MAX_VND];
+	struct net_device *rmnet_devices[RMNET_MAX_LOGICAL_EP];
 	u8 nr_rmnet_devs;
 };
 
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
index ed820b5..7967198 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
@@ -13,7 +13,6 @@
 #ifndef _RMNET_PRIVATE_H_
 #define _RMNET_PRIVATE_H_
 
-#define RMNET_MAX_VND              32
 #define RMNET_MAX_PACKET_SIZE      16384
 #define RMNET_DFLT_PACKET_SIZE     1500
 #define RMNET_NEEDED_HEADROOM      16
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index bf7455f..0e0001b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
 
 int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)
 {
-	if (id >= RMNET_MAX_VND || !r->rmnet_devices[id])
+	if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id])
 		return -EINVAL;
 
 	r->rmnet_devices[id] = NULL;
-- 
1.9.1

  reply	other threads:[~2017-09-03  5:31 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-03  5:30 [PATCH net-next 0/6] net: qualcomm: rmnet: Fix comments on initial patchset Subash Abhinov Kasiviswanathan
2017-09-03  5:30 ` Subash Abhinov Kasiviswanathan [this message]
2017-09-03  5:30 ` [PATCH net-next 2/6] net: qualcomm: rmnet: Remove the unused endpoint -1 Subash Abhinov Kasiviswanathan
2017-09-03  5:30 ` [PATCH net-next 3/6] net: qualcomm: rmnet: Move the device creation log Subash Abhinov Kasiviswanathan
2017-09-03  5:30 ` [PATCH net-next 4/6] net: qualcomm: rmnet: Refactor the new rmnet dev creation Subash Abhinov Kasiviswanathan
2017-09-03  5:30 ` [PATCH net-next 5/6] net: qualcomm: rmnet: Implement ndo_get_iflink Subash Abhinov Kasiviswanathan
2017-09-03  5:30 ` [PATCH net-next 6/6] net: qualcomm: rmnet: Rename real_dev_info to port Subash Abhinov Kasiviswanathan
2017-09-04  4:27 ` [PATCH net-next 0/6] net: qualcomm: rmnet: Fix comments on initial patchset David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1504416646-9527-2-git-send-email-subashab@codeaurora.org \
    --to=subashab@codeaurora.org \
    --cc=davem@davemloft.net \
    --cc=dcbw@redhat.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.