diff options
| author | Karthikeyan Ramasubramanian <kramasub@codeaurora.org> | 2016-02-22 16:30:40 -0700 |
|---|---|---|
| committer | Mekala Natarajan <mnatarajan@google.com> | 2016-08-08 17:25:36 -0700 |
| commit | 4e0bcb375c06351c5494457debba0f4a9d0fb244 (patch) | |
| tree | 37a6c2904bf37f3ca7a1ceb416050f1c4432f491 | |
| parent | 3888887aa8f27a3db63e36a8afce3557ed91b341 (diff) | |
net: ipc_router: Bind only a client port as control portandroid-6.0.1_r0.121
IPC Router binds any port as a control port and moves it from the client
port list to control port list. Misbehaving clients can exploit this
incorrect behavior.
IPC Router to check if the port is a client port before binding it as a
control port.
Bug: 27045580
CRs-Fixed: 974577
Change-Id: I9f189b76967d5f85750218a7cb6537d187a69663
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
| -rw-r--r-- | net/ipc_router/ipc_router_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/ipc_router/ipc_router_core.c b/net/ipc_router/ipc_router_core.c index 7106ba2bce4c..12f264a00d86 100644 --- a/net/ipc_router/ipc_router_core.c +++ b/net/ipc_router/ipc_router_core.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -3279,7 +3279,7 @@ int msm_ipc_router_get_curr_pkt_size(struct msm_ipc_port *port_ptr) int msm_ipc_router_bind_control_port(struct msm_ipc_port *port_ptr) { - if (!port_ptr) + if (unlikely(!port_ptr || port_ptr->type != CLIENT_PORT)) return -EINVAL; down_write(&local_ports_lock_lhc2); |