From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
To: netdev@vger.kernel.org, davem@davemloft.net
Cc: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>,
Dan Williams <dcbw@redhat.com>
Subject: [PATCH net-next 1/6] net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32
Date: Sat, 2 Sep 2017 23:30:41 -0600 [thread overview]
Message-ID: <1504416646-9527-2-git-send-email-subashab@codeaurora.org> (raw)
In-Reply-To: <1504416646-9527-1-git-send-email-subashab@codeaurora.org>
rmnet_rtnl_validate() was checking for upto mux_id 254, however the
rmnet_devices devices could hold upto 32 entries only. Fix this by
increasing the size of the rmnet_devices.
Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Dan Williams <dcbw@redhat.com>
---
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 3 +--
drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h | 1 -
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 2 +-
3 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 985d372..40b6b32 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -19,7 +19,6 @@
#define _RMNET_CONFIG_H_
#define RMNET_MAX_LOGICAL_EP 255
-#define RMNET_MAX_VND 32
/* Information about the next device to deliver the packet to.
* Exact usage of this parameter depends on the rmnet_mode.
@@ -39,7 +38,7 @@ struct rmnet_real_dev_info {
struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];
u32 ingress_data_format;
u32 egress_data_format;
- struct net_device *rmnet_devices[RMNET_MAX_VND];
+ struct net_device *rmnet_devices[RMNET_MAX_LOGICAL_EP];
u8 nr_rmnet_devs;
};
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
index ed820b5..7967198 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h
@@ -13,7 +13,6 @@
#ifndef _RMNET_PRIVATE_H_
#define _RMNET_PRIVATE_H_
-#define RMNET_MAX_VND 32
#define RMNET_MAX_PACKET_SIZE 16384
#define RMNET_DFLT_PACKET_SIZE 1500
#define RMNET_NEEDED_HEADROOM 16
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index bf7455f..0e0001b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)
{
- if (id >= RMNET_MAX_VND || !r->rmnet_devices[id])
+ if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id])
return -EINVAL;
r->rmnet_devices[id] = NULL;
--
1.9.1
next prev parent reply other threads:[~2017-09-03 5:31 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-03 5:30 [PATCH net-next 0/6] net: qualcomm: rmnet: Fix comments on initial patchset Subash Abhinov Kasiviswanathan
2017-09-03 5:30 ` Subash Abhinov Kasiviswanathan [this message]
2017-09-03 5:30 ` [PATCH net-next 2/6] net: qualcomm: rmnet: Remove the unused endpoint -1 Subash Abhinov Kasiviswanathan
2017-09-03 5:30 ` [PATCH net-next 3/6] net: qualcomm: rmnet: Move the device creation log Subash Abhinov Kasiviswanathan
2017-09-03 5:30 ` [PATCH net-next 4/6] net: qualcomm: rmnet: Refactor the new rmnet dev creation Subash Abhinov Kasiviswanathan
2017-09-03 5:30 ` [PATCH net-next 5/6] net: qualcomm: rmnet: Implement ndo_get_iflink Subash Abhinov Kasiviswanathan
2017-09-03 5:30 ` [PATCH net-next 6/6] net: qualcomm: rmnet: Rename real_dev_info to port Subash Abhinov Kasiviswanathan
2017-09-04 4:27 ` [PATCH net-next 0/6] net: qualcomm: rmnet: Fix comments on initial patchset David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1504416646-9527-2-git-send-email-subashab@codeaurora.org \
--to=subashab@codeaurora.org \
--cc=davem@davemloft.net \
--cc=dcbw@redhat.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).