From 009e1b2b7a302219562999f3b273bd4cbf4d9b40 Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Sat, 2 Sep 2017 23:30:41 -0600 Subject: net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32 rmnet_rtnl_validate() was checking for upto mux_id 254, however the rmnet_devices devices could hold upto 32 entries only. Fix this by increasing the size of the rmnet_devices. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Subash Abhinov Kasiviswanathan Cc: Dan Williams Signed-off-by: David S. Miller --- drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c') diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c index bf7455fdafcc..0e0001becb61 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c @@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev, int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r) { - if (id >= RMNET_MAX_VND || !r->rmnet_devices[id]) + if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id]) return -EINVAL; r->rmnet_devices[id] = NULL; -- cgit v1.2.3