Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 199b0eae authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

diag: Ensure dci entry is valid before sending the packet 



Possibility of a race condition which can free the dci entry
causing use after free case is prevented by adding the check
for entry's validity.

Change-Id: Ib436ffd16c266636d99885d6091eb1a6887737c7
Signed-off-by: default avatarManoj Prabhu B <quic_bmanoj@quicinc.com>
parent 6f0d0c6b

drivers/char/diag/diag_dci.c

+5 −5
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2022, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -1619,7 +1619,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		return -EIO;

	}



	mutex_lock(&driver->dci_mutex);

	/* prepare DCI packet */

	header.start = CONTROL_CHAR;

	header.version = 1;
@@ -1638,7 +1637,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		diag_update_pkt_buffer(driver->apps_dci_buf, write_len,

				       DCI_PKT_TYPE);

		diag_update_sleeping_process(entry->pid, DCI_PKT_TYPE);

		mutex_unlock(&driver->dci_mutex);

		return DIAG_DCI_NO_ERROR;

	}
@@ -1658,7 +1656,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		       entry->proc);

		status = DIAG_DCI_SEND_DATA_FAIL;

	}

	mutex_unlock(&driver->dci_mutex);

	return status;

}
@@ -2130,8 +2127,11 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	if (temp_entry) {

		reg_item = container_of(temp_entry, struct diag_cmd_reg_t,

								entry);

		mutex_lock(&driver->dci_mutex);

		if (req_entry)

			ret = diag_send_dci_pkt(reg_item, req_buf, req_len,

					req_entry->tag);

		mutex_unlock(&driver->dci_mutex);

	} else {

		DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",

				reg_entry.cmd_code, reg_entry.subsys_id,