net: ipc_router: Add bounds check on tx path

Add bounds check on values read from shared memory in the tx path.
In cases where the VM is misbehaving, the ipcrtr fifo xport should
exit and print a warning when bogus values may cause out of bounds to
be read.

Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d
Signed-off-by: Sarannya S <[email protected]>

Author: Sarannya S

net/ipc_router/ipc_router_fifo_xprt.c

@@ -129,6 +129,9 @@ static size_t fifo_tx_avail(struct msm_ipc_pipe *pipe)
 	else
 		avail = tail - head;
 
+	if (WARN_ON_ONCE(avail > pipe->length))
+		avail = 0;
+
 	return avail;
 }
 
@@ -139,6 +142,8 @@ static void fifo_tx_write(struct msm_ipc_pipe *pipe,
 	u32 head;
 
 	head = le32_to_cpu(*pipe->head);
+	if (WARN_ON_ONCE(head > pipe->length))
+		return;
 
 	len = min_t(size_t, count, pipe->length - head);
 	if (len)