From a714b4b32615af65c4275c0b59146e9974330646 Mon Sep 17 00:00:00 2001 From: Sarannya S Date: Fri, 23 Dec 2022 15:42:29 +0530 Subject: [PATCH] net: qrtr: fifo: Add bounds check on tx path Add bounds check on values read from shared memory in the tx path. In cases where the VM is misbehaving, the qrtr transport should exit and print a warning when bogus values may cause out of bounds to be read. Change-Id: I7ebef28ed8eba4c4da0b32d5114365bbe6bea390 Signed-off-by: Sarannya S --- net/qrtr/fifo.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/qrtr/fifo.c b/net/qrtr/fifo.c index c4cf487764ba..76b94d3582b8 100644 --- a/net/qrtr/fifo.c +++ b/net/qrtr/fifo.c @@ -120,6 +120,9 @@ static size_t fifo_tx_avail(struct fifo_pipe *pipe) else avail = tail - head; + if (WARN_ON_ONCE(avail > pipe->length)) + avail = 0; + return avail; } @@ -130,6 +133,8 @@ static void fifo_tx_write(struct fifo_pipe *pipe, u32 head; head = le32_to_cpu(*pipe->head); + if (WARN_ON_ONCE(head > pipe->length)) + return; len = min_t(size_t, count, pipe->length - head); if (len)