him411/nss-packages-qosmio
1
0
Fork 0
mirror of https://github.com/qosmio/nss-packages.git synced 2025-12-18 01:01:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

nss-drv: fix null ptr deref when logging is enabled

Browse Source 
When debug logging is enabled for bridge or gre a null
pointer deref error was causing system to crash

Signed-off-by: Sean Khan <datapronix@protonmail.com>
This commit is contained in:
Sean Khan 2025-07-10 20:37:06 -04:00
parent a6d4d5bfc3
commit 5cb2492405
2 changed files with 92 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
qca-nss-drv/patches-11.4/0027-nss-drv-fix-null-ptr-log.patch Normal file
View File

@ -0,0 +1,46 @@
--- a/nss_bridge_log.c
+++ b/nss_bridge_log.c
@@ -99,7 +99,7 @@ static void nss_bridge_log_verbose(struc
*/
void nss_bridge_log_tx_msg(struct nss_bridge_msg *nbm)
{
- if (nbm->cm.type >= NSS_BRIDGE_MSG_TYPE_MAX) {
+ if (nbm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || nbm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_BRIDGE_MSG_TYPE_MAX + 1)) {
nss_warning("%px: Invalid message type\n", nbm);
return;
}
@@ -119,6 +119,11 @@ void nss_bridge_log_rx_msg(struct nss_br
return;
}
+ if (nbm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || nbm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_BRIDGE_MSG_TYPE_MAX + 1)) {
+ nss_warning("%px: Invalid message type\n", nbm);
+ return;
+ }
+
if (nbm->cm.response == NSS_CMN_RESPONSE_NOTIFY || (nbm->cm.response == NSS_CMN_RESPONSE_ACK)) {
nss_info("%px: type[%d]:%s, response[%d]:%s\n", nbm, nbm->cm.type,
nss_bridge_log_message_types_str[nbm->cm.type - NSS_IF_MAX_MSG_TYPES - 1],
--- a/nss_gre_log.c
+++ b/nss_gre_log.c
@@ -151,7 +151,7 @@ static void nss_gre_log_verbose(struct n
*/
void nss_gre_log_tx_msg(struct nss_gre_msg *ngm)
{
- if (ngm->cm.type >= NSS_GRE_MSG_MAX) {
+ if (ngm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || ngm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_GRE_MSG_MAX + 1)) {
nss_warning("%px: Invalid message type\n", ngm);
return;
}
@@ -171,6 +171,11 @@ void nss_gre_log_rx_msg(struct nss_gre_m
return;
}
+ if (ngm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || ngm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_GRE_MSG_MAX + 1)) {
+ nss_warning("%px: Invalid message type\n", ngm);
+ return;
+ }
+
if (ngm->cm.response == NSS_CMN_RESPONSE_NOTIFY || (ngm->cm.response == NSS_CMN_RESPONSE_ACK)) {
nss_info("%px: type[%d]:%s, response[%d]:%s\n", ngm, ngm->cm.type,
nss_gre_log_message_types_str[NSS_GRE_LOG_MESSAGE_TYPE_INDEX(ngm->cm.type)],

46
qca-nss-drv/patches/0027-nss-drv-fix-null-ptr-log.patch Normal file
View File

@ -0,0 +1,46 @@
--- a/nss_bridge_log.c
+++ b/nss_bridge_log.c
@@ -99,7 +99,7 @@ static void nss_bridge_log_verbose(struc
*/
void nss_bridge_log_tx_msg(struct nss_bridge_msg *nbm)
{
- if (nbm->cm.type >= NSS_BRIDGE_MSG_TYPE_MAX) {
+ if (nbm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || nbm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_BRIDGE_MSG_TYPE_MAX + 1)) {
nss_warning("%px: Invalid message type\n", nbm);
return;
}
@@ -119,6 +119,11 @@ void nss_bridge_log_rx_msg(struct nss_br
return;
}
+ if (nbm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || nbm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_BRIDGE_MSG_TYPE_MAX + 1)) {
+ nss_warning("%px: Invalid message type\n", nbm);
+ return;
+ }
+
if (nbm->cm.response == NSS_CMN_RESPONSE_NOTIFY || (nbm->cm.response == NSS_CMN_RESPONSE_ACK)) {
nss_info("%px: type[%d]:%s, response[%d]:%s\n", nbm, nbm->cm.type,
nss_bridge_log_message_types_str[nbm->cm.type - NSS_IF_MAX_MSG_TYPES - 1],
--- a/nss_gre_log.c
+++ b/nss_gre_log.c
@@ -151,7 +151,7 @@ static void nss_gre_log_verbose(struct n
*/
void nss_gre_log_tx_msg(struct nss_gre_msg *ngm)
{
- if (ngm->cm.type >= NSS_GRE_MSG_MAX) {
+ if (ngm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || ngm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_GRE_MSG_MAX + 1)) {
nss_warning("%px: Invalid message type\n", ngm);
return;
}
@@ -171,6 +171,11 @@ void nss_gre_log_rx_msg(struct nss_gre_m
return;
}
+ if (ngm->cm.type < (NSS_IF_MAX_MSG_TYPES + 1) || ngm->cm.type >= (NSS_IF_MAX_MSG_TYPES + NSS_GRE_MSG_MAX + 1)) {
+ nss_warning("%px: Invalid message type\n", ngm);
+ return;
+ }
+
if (ngm->cm.response == NSS_CMN_RESPONSE_NOTIFY || (ngm->cm.response == NSS_CMN_RESPONSE_ACK)) {
nss_info("%px: type[%d]:%s, response[%d]:%s\n", ngm, ngm->cm.type,
nss_gre_log_message_types_str[NSS_GRE_LOG_MESSAGE_TYPE_INDEX(ngm->cm.type)],