| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
| |
sockaddr structure is filled with required information only which
results in few memory locations of structure with uninitialized data.
Memset complete structure before using it to remove uninitialized data.
CRs-Fixed: 2274853
Change-Id: I181710bde100fb1553b925d9fdf227af35ff38b5
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
|
| |
|
|
|
|
|
|
|
| |
The skb_peek and skb_peek_tail functions can return NULL if the skb
list is empty. Check the return value before using the skb.
CRs-Fixed: 2121368
Change-Id: If14320104ec37b8b7504e930ed8fd06e72d08724
Signed-off-by: Chris Lew <clew@codeaurora.org>
|
| |
|
|
|
|
|
|
|
|
|
| |
Fail cases of accept() system call on AF_MSM_IPC socket family causes
NULL pointer de-reference of sock structure variable in release operation.
Validate the sock structure pointer before using it in release operation.
CRs-Fixed: 1068888
Change-Id: I5637e52be59ea9504ea6ae317394bef0c28c7865
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
IPC Router assigns NULL to write_space callback for all sockets in its
family by defaults. The setsockopt operation with SO_SNDBUF option
accesses write_space callback without checking its validity. This may
lead to a NULL pointer dereferencing when that operation is performed.
Assign a dummy write_space callback operation by default to all IPC Router
sockets.
CRs-Fixed: 1025150
Change-Id: Id2454683116c948b7bb4fa3c50a91a5a9585a491
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The service info structure is allocated with uninitialized memory for the
max number of services and returns the complete structure to the usersapce
resulting in the information leak if lookup operation finds less number of
services than the requested number.
Check the minimum of requested and available services and copy the minimum
information to the user-space.
CRs-Fixed: 965934
Change-Id: Ic97f875855fdc6440c1db1d8d0338ee8b03a9d0a
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
|
| |
|
|
|
|
|
|
| |
The networking module uses iov_iter library to manage the vector buffers
from user-space. Use iov_iter accessor functions to copy the data from/to
the user-space vector buffers.
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
|
| |
|
|
|
|
|
|
| |
Update the function signature of sendmsg and recvmsg operations.
Pass the kernel socket flag to the updated socket object allocation
function.
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
|
| |
|
|
|
|
|
| |
qmi_encdec.h header file is no longer required in IPC Router. Remove
including that header file.
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
|
|
|
This snapshot is taken as of msm-3.18 commit e70ad0cd (Promotion of
kernel.lnx.3.18-151201.)
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
|
