Merge "coresight: tmc: Fix use after free issue with tmc read" (2ca7082e) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/hwtracing/coresight/coresight-tmc-etr.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -933,6 +933,7 @@ int tmc_read_prepare_etr(struct tmc_drvdata *drvdata)
		if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
		return -EINVAL;

		mutex_lock(&drvdata->mem_lock);
		spin_lock_irqsave(&drvdata->spinlock, flags);
		if (drvdata->reading) {
		ret = -EBUSY;
		@@ -964,6 +965,7 @@ int tmc_read_prepare_etr(struct tmc_drvdata *drvdata)
		drvdata->reading = true;
		out:
		spin_unlock_irqrestore(&drvdata->spinlock, flags);
		mutex_unlock(&drvdata->mem_lock);

		return ret;
		}

+8 −1

Original line number	Diff line number	Diff line
		@@ -142,7 +142,11 @@ static ssize_t tmc_read(struct file file, char __user data, size_t len,
		{
		struct tmc_drvdata *drvdata = container_of(file->private_data,
		struct tmc_drvdata, miscdev);
		char bufp = drvdata->buf + ppos;
		char *bufp;

		mutex_lock(&drvdata->mem_lock);

		bufp = drvdata->buf + *ppos;

		if (*ppos + len > drvdata->len)
		len = drvdata->len - *ppos;
		@@ -165,6 +169,7 @@ static ssize_t tmc_read(struct file file, char __user data, size_t len,

		if (copy_to_user(data, bufp, len)) {
		dev_dbg(drvdata->dev, "%s: copy_to_user failed\n", __func__);
		mutex_unlock(&drvdata->mem_lock);
		return -EFAULT;
		}

		@@ -172,6 +177,8 @@ static ssize_t tmc_read(struct file file, char __user data, size_t len,

		dev_dbg(drvdata->dev, "%s: %zu bytes copied, %d bytes left\n",
		__func__, len, (int)(drvdata->len - *ppos));

		mutex_unlock(&drvdata->mem_lock);
		return len;
		}