joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

diag: Validate the dci client before sending dci packet

Browse source 
Ensure dci client's tag used is a valid one by validating against
its status before sending the dci packet to client.

Change-Id: Ia673e8b548e441eb907820dc395c22b7f1b75d10
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
This commit is contained in:
Manoj Prabhu B 2022-02-02 11:42:11 +05:30 • committed by Gerrit - the friendly Code Review server
commit 4d3d93cb5e
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
drivers/char/diag/diag_dci.c
View file

@ -1981,12 +1981,13 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
{
int ret = DIAG_DCI_TABLE_ERR;
int common_cmd = 0, header_len = 0;
int req_tag = 0;
struct diag_pkt_header_t *header = NULL;
unsigned char *temp = buf;
unsigned char *req_buf = NULL;
uint8_t retry_count = 0, max_retries = 3;
uint32_t read_len = 0, req_len = len;
struct dci_pkt_req_entry_t *req_entry = NULL;
struct dci_pkt_req_entry_t *req_entry = NULL, *test_entry = NULL;
struct diag_dci_client_tbl *dci_entry = NULL;
struct dci_pkt_req_t req_hdr;
struct diag_cmd_reg_t *reg_item;
@ -2090,6 +2091,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
mutex_unlock(&driver->dci_mutex);
return DIAG_DCI_NO_REG;
}
req_tag = req_entry->tag;
mutex_unlock(&driver->dci_mutex);
/*
@ -2097,14 +2099,14 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
* remote processor
*/
if (dci_entry->client_info.token > 0) {
ret = diag_send_dci_pkt_remote(req_buf, req_len, req_entry->tag,
ret = diag_send_dci_pkt_remote(req_buf, req_len, req_tag,
dci_entry->client_info.token);
return ret;
}
/* Check if it is a dedicated Apps command */
ret = diag_dci_process_apps_pkt(header, req_buf, req_len,
req_entry->tag, header_len);
req_tag, header_len);
if ((ret == DIAG_DCI_NO_ERROR && !common_cmd) || ret < 0)
return ret;
@ -2128,9 +2130,12 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
reg_item = container_of(temp_entry, struct diag_cmd_reg_t,
entry);
mutex_lock(&driver->dci_mutex);
if (req_entry)
test_entry = diag_dci_get_request_entry(req_tag);
if (test_entry)
ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
req_entry->tag);
test_entry->tag);
else
ret = -EIO;
mutex_unlock(&driver->dci_mutex);
} else {
DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",