diff options
| -rw-r--r-- | net/ipc_router/ipc_router_core.c | 14 | ||||
| -rw-r--r-- | net/ipc_router/ipc_router_socket.c | 6 |
2 files changed, 17 insertions, 3 deletions
diff --git a/net/ipc_router/ipc_router_core.c b/net/ipc_router/ipc_router_core.c index 5cb309a11f82..b4506280e3e4 100644 --- a/net/ipc_router/ipc_router_core.c +++ b/net/ipc_router/ipc_router_core.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2936,6 +2936,10 @@ static int loopback_data(struct msm_ipc_port *src, } temp_skb = skb_peek_tail(pkt->pkt_fragment_q); + if (!temp_skb) { + IPC_RTR_ERR("%s: Empty skb\n", __func__); + return -EINVAL; + } align_size = ALIGN_SIZE(pkt->length); skb_put(temp_skb, align_size); pkt->length += align_size; @@ -3097,6 +3101,11 @@ static int msm_ipc_router_write_pkt(struct msm_ipc_port *src, } temp_skb = skb_peek_tail(pkt->pkt_fragment_q); + if (!temp_skb) { + IPC_RTR_ERR("%s: Abort invalid pkt\n", __func__); + ret = -EINVAL; + goto out_write_pkt; + } align_size = ALIGN_SIZE(pkt->length); skb_put(temp_skb, align_size); pkt->length += align_size; @@ -3424,7 +3433,8 @@ int msm_ipc_router_recv_from(struct msm_ipc_port *port_ptr, align_size = ALIGN_SIZE(data_len); if (align_size) { temp_skb = skb_peek_tail((*pkt)->pkt_fragment_q); - skb_trim(temp_skb, (temp_skb->len - align_size)); + if (temp_skb) + skb_trim(temp_skb, (temp_skb->len - align_size)); } return data_len; } diff --git a/net/ipc_router/ipc_router_socket.c b/net/ipc_router/ipc_router_socket.c index b15356ae26fc..23e4443fc1b2 100644 --- a/net/ipc_router/ipc_router_socket.c +++ b/net/ipc_router/ipc_router_socket.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -138,6 +138,10 @@ static int msm_ipc_router_extract_msg(struct msghdr *m, hdr = &(pkt->hdr); if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_RESUME_TX)) { temp = skb_peek(pkt->pkt_fragment_q); + if (!temp || !temp->data) { + IPC_RTR_ERR("%s: Invalid skb\n", __func__); + return -EINVAL; + } ctl_msg = (union rr_control_msg *)(temp->data); addr->family = AF_MSM_IPC; addr->address.addrtype = MSM_IPC_ADDR_ID; |