msm: bam_dmux: Add range check of logical channel ID
When receiving remote commands, check for a valid logical
channel ID before processing the command.
Change-Id: Ie3e5ff9a05a0f2ce407e21c0d709d3ac4e0f7725
Signed-off-by: Eric Holmberg <eholmber@codeaurora.org>
diff --git a/arch/arm/mach-msm/bam_dmux.c b/arch/arm/mach-msm/bam_dmux.c
index 5e2d311..c70e1b5 100644
--- a/arch/arm/mach-msm/bam_dmux.c
+++ b/arch/arm/mach-msm/bam_dmux.c
@@ -292,6 +292,17 @@
queue_rx();
return;
}
+
+ if (rx_hdr->ch_id >= BAM_DMUX_NUM_CHANNELS) {
+ pr_err("%s: dropping invalid LCID %d reserved %d cmd %d"
+ " pad %d ch %d len %d\n", __func__,
+ rx_hdr->ch_id, rx_hdr->reserved, rx_hdr->cmd,
+ rx_hdr->pad_len, rx_hdr->ch_id, rx_hdr->pkt_len);
+ dev_kfree_skb_any(rx_skb);
+ queue_rx();
+ return;
+ }
+
switch (rx_hdr->cmd) {
case BAM_MUX_HDR_CMD_DATA:
DBG_INC_READ_CNT(rx_hdr->pkt_len);