net: qualcomm: rmnet: Fix memory corruption if mux_id is greater than 32

rmnet_rtnl_validate() was checking for upto mux_id 254, however the
rmnet_devices devices could hold upto 32 entries only. Fix this by
increasing the size of the rmnet_devices.

Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: NSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Dan Williams <dcbw@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h

@@ -19,7 +19,6 @@
 #define _RMNET_CONFIG_H_
 
 #define RMNET_MAX_LOGICAL_EP 255
-#define RMNET_MAX_VND        32
 
 /* Information about the next device to deliver the packet to.
  * Exact usage of this parameter depends on the rmnet_mode.
@@ -39,7 +38,7 @@ struct rmnet_real_dev_info {
 	struct rmnet_endpoint muxed_ep[RMNET_MAX_LOGICAL_EP];
 	u32 ingress_data_format;
 	u32 egress_data_format;
-	struct net_device *rmnet_devices[RMNET_MAX_VND];
+	struct net_device *rmnet_devices[RMNET_MAX_LOGICAL_EP];
 	u8 nr_rmnet_devs;
 };
 

drivers/net/ethernet/qualcomm/rmnet/rmnet_private.h

@@ -13,7 +13,6 @@
 #ifndef _RMNET_PRIVATE_H_
 #define _RMNET_PRIVATE_H_
 
-#define RMNET_MAX_VND              32
 #define RMNET_MAX_PACKET_SIZE      16384
 #define RMNET_DFLT_PACKET_SIZE     1500
 #define RMNET_NEEDED_HEADROOM      16

drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c

@@ -112,7 +112,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
 
 int rmnet_vnd_dellink(u8 id, struct rmnet_real_dev_info *r)
 {
-	if (id >= RMNET_MAX_VND || !r->rmnet_devices[id])
+	if (id >= RMNET_MAX_LOGICAL_EP || !r->rmnet_devices[id])
 		return -EINVAL;
 
 	r->rmnet_devices[id] = NULL;