net: ipc_router: Validate return from skb_peek
The skb_peek and skb_peek_tail functions can return NULL if the skb
list is empty. Check the return value before using the skb.
CRs-Fixed: 2121368
Change-Id: If14320104ec37b8b7504e930ed8fd06e72d08724
Signed-off-by: Chris Lew <clew@codeaurora.org>
diff --git a/net/ipc_router/ipc_router_core.c b/net/ipc_router/ipc_router_core.c
index a28b1af..d38157d 100644
--- a/net/ipc_router/ipc_router_core.c
+++ b/net/ipc_router/ipc_router_core.c
@@ -2925,6 +2925,10 @@
}
temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
+ if (!temp_skb) {
+ IPC_RTR_ERR("%s: Empty skb\n", __func__);
+ return -EINVAL;
+ }
align_size = ALIGN_SIZE(pkt->length);
skb_put(temp_skb, align_size);
pkt->length += align_size;
@@ -3089,6 +3093,11 @@
}
temp_skb = skb_peek_tail(pkt->pkt_fragment_q);
+ if (!temp_skb) {
+ IPC_RTR_ERR("%s: Abort invalid pkt\n", __func__);
+ ret = -EINVAL;
+ goto out_write_pkt;
+ }
align_size = ALIGN_SIZE(pkt->length);
skb_put(temp_skb, align_size);
pkt->length += align_size;
@@ -3408,7 +3417,8 @@
align_size = ALIGN_SIZE(data_len);
if (align_size) {
temp_skb = skb_peek_tail((*pkt)->pkt_fragment_q);
- skb_trim(temp_skb, (temp_skb->len - align_size));
+ if (temp_skb)
+ skb_trim(temp_skb, (temp_skb->len - align_size));
}
return data_len;
}
diff --git a/net/ipc_router/ipc_router_socket.c b/net/ipc_router/ipc_router_socket.c
index 02242a1..a758a09 100644
--- a/net/ipc_router/ipc_router_socket.c
+++ b/net/ipc_router/ipc_router_socket.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -141,6 +141,10 @@
hdr = &pkt->hdr;
if (addr && (hdr->type == IPC_ROUTER_CTRL_CMD_RESUME_TX)) {
temp = skb_peek(pkt->pkt_fragment_q);
+ if (!temp || !temp->data) {
+ IPC_RTR_ERR("%s: Invalid skb\n", __func__);
+ return -EINVAL;
+ }
ctl_msg = (union rr_control_msg *)(temp->data);
addr->family = AF_MSM_IPC;
addr->address.addrtype = MSM_IPC_ADDR_ID;