joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

diag: Ensure dci entry is valid before sending the packet

Browse source 
Possibility of a race condition which can free the dci entry
causing use after free case is prevented by adding the check
for entry's validity.

Change-Id: Ib436ffd16c266636d99885d6091eb1a6887737c7
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
This commit is contained in:
Manoj Prabhu B 2022-01-20 15:00:05 +05:30 • committed by Gerrit - the friendly Code Review server
commit 199b0eaef0
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/char/diag/diag_dci.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
/* Copyright (c) 2012-2022, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -1619,7 +1619,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
return -EIO;
}
mutex_lock(&driver->dci_mutex);
/* prepare DCI packet */
header.start = CONTROL_CHAR;
header.version = 1;
@ -1638,7 +1637,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
diag_update_pkt_buffer(driver->apps_dci_buf, write_len,
DCI_PKT_TYPE);
diag_update_sleeping_process(entry->pid, DCI_PKT_TYPE);
mutex_unlock(&driver->dci_mutex);
return DIAG_DCI_NO_ERROR;
}
@ -1658,7 +1656,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry,
entry->proc);
status = DIAG_DCI_SEND_DATA_FAIL;
}
mutex_unlock(&driver->dci_mutex);
return status;
}
@ -2130,8 +2127,11 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
if (temp_entry) {
reg_item = container_of(temp_entry, struct diag_cmd_reg_t,
entry);
ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
mutex_lock(&driver->dci_mutex);
if (req_entry)
ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
req_entry->tag);
mutex_unlock(&driver->dci_mutex);
} else {
DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",
reg_entry.cmd_code, reg_entry.subsys_id,