net: ipc_router: Add bounds check on tx path
Add bounds check on values read from shared memory in the tx path.
In cases where the VM is misbehaving, the ipcrtr fifo xport should
exit and print a warning when bogus values may cause out of bounds to
be read.
Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
diff --git a/net/ipc_router/ipc_router_fifo_xprt.c b/net/ipc_router/ipc_router_fifo_xprt.c
index c90534d..d55c5ab 100644
--- a/net/ipc_router/ipc_router_fifo_xprt.c
+++ b/net/ipc_router/ipc_router_fifo_xprt.c
@@ -129,6 +129,9 @@ static size_t fifo_tx_avail(struct msm_ipc_pipe *pipe)
else
avail = tail - head;
+ if (WARN_ON_ONCE(avail > pipe->length))
+ avail = 0;
+
return avail;
}
@@ -139,6 +142,8 @@ static void fifo_tx_write(struct msm_ipc_pipe *pipe,
u32 head;
head = le32_to_cpu(*pipe->head);
+ if (WARN_ON_ONCE(head > pipe->length))
+ return;
len = min_t(size_t, count, pipe->length - head);
if (len)