Merge "diag: Validate command length against size of command structure" (389a0bd2) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/char/diag/diagfwd.c

+48 −26

Original line number	Diff line number	Diff line
		@@ -1026,7 +1026,7 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		uint32_t pd_mask = 0;
		struct diag_md_session_t *info = NULL;

		if (!buf)
		if (!buf \|\| len <= 0)
		return -EIO;

		/* Check if the command is a supported mask command */
		@@ -1037,18 +1037,31 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		}

		temp = buf;
		if (len >= sizeof(uint8_t)) {
		entry.cmd_code = (uint16_t)((uint8_t )temp);
		pr_debug("diag: received cmd_code %02x\n", entry.cmd_code);
		}
		if (len >= (2 * sizeof(uint8_t))) {
		temp += sizeof(uint8_t);
		entry.subsys_id = (uint16_t)((uint8_t )temp);
		pr_debug("diag: received subsys_id %02x\n", entry.subsys_id);
		}
		if (len == (3 * sizeof(uint8_t))) {
		temp += sizeof(uint8_t);
		entry.cmd_code_hi = (uint16_t)((uint8_t )temp);
		entry.cmd_code_lo = (uint16_t)((uint8_t )temp);
		pr_debug("diag: received cmd_code_hi %02x\n",
		entry.cmd_code_hi);
		} else if (len >= (2 * sizeof(uint8_t)) + sizeof(uint16_t)) {
		temp += sizeof(uint8_t);
		entry.cmd_code_hi = (uint16_t)((uint16_t )temp);
		entry.cmd_code_lo = (uint16_t)((uint16_t )temp);
		temp += sizeof(uint16_t);

		pr_debug("diag: In %s, received cmd %02x %02x %02x\n",
		__func__, entry.cmd_code, entry.subsys_id, entry.cmd_code_hi);
		pr_debug("diag: received cmd_code_hi %02x\n",
		entry.cmd_code_hi);
		}

		if (*buf == DIAG_CMD_LOG_ON_DMND && driver->log_on_demand_support &&
		if ((len >= sizeof(uint8_t)) && *buf == DIAG_CMD_LOG_ON_DMND &&
		driver->log_on_demand_support &&
		driver->feature[PERIPHERAL_MODEM].rcvd_feature_mask) {
		write_len = diag_cmd_log_on_demand(buf, len,
		driver->apps_rsp_buf,
		@@ -1091,14 +1104,16 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)

		#if defined(CONFIG_DIAG_OVER_USB)
		/* Check for the command/respond msg for the maximum packet length */
		if ((buf == 0x4b) && ((buf+1) == 0x12) &&
		if ((len >= (4 * sizeof(uint8_t))) &&
		(buf == 0x4b) && ((buf+1) == 0x12) &&
		((uint16_t )(buf+2) == 0x0055)) {
		for (i = 0; i < 4; i++)
		(driver->apps_rsp_buf+i) = (buf+i);
		(uint32_t )(driver->apps_rsp_buf+4) = DIAG_MAX_REQ_SIZE;
		diag_send_rsp(driver->apps_rsp_buf, 8, pid);
		return 0;
		} else if ((buf == 0x4b) && ((buf+1) == 0x12) &&
		} else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&
		(buf == 0x4b) && ((buf+1) == 0x12) &&
		((uint16_t )(buf+2) == DIAG_DIAG_STM)) {
		len = diag_process_stm_cmd(buf, driver->apps_rsp_buf);
		if (len > 0) {
		@@ -1108,7 +1123,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return len;
		}
		/* Check for time sync query command */
		else if ((*buf == DIAG_CMD_DIAG_SUBSYS) &&
		else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&
		(*buf == DIAG_CMD_DIAG_SUBSYS) &&
		(*(buf+1) == DIAG_SS_DIAG) &&
		((uint16_t )(buf+2) == DIAG_GET_TIME_API)) {
		write_len = diag_process_time_sync_query_cmd(buf, len,
		@@ -1119,7 +1135,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Check for time sync switch command */
		else if ((*buf == DIAG_CMD_DIAG_SUBSYS) &&
		else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&
		(*buf == DIAG_CMD_DIAG_SUBSYS) &&
		(*(buf+1) == DIAG_SS_DIAG) &&
		((uint16_t )(buf+2) == DIAG_SET_TIME_API)) {
		write_len = diag_process_time_sync_switch_cmd(buf, len,
		@@ -1130,7 +1147,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Check for diag id command */
		else if ((*buf == DIAG_CMD_DIAG_SUBSYS) &&
		else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&
		(*buf == DIAG_CMD_DIAG_SUBSYS) &&
		(*(buf+1) == DIAG_SS_DIAG) &&
		((uint16_t )(buf+2) == DIAG_GET_DIAG_ID)) {
		write_len = diag_process_diag_id_query_cmd(buf, len,
		@@ -1141,7 +1159,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Check for download command */
		else if ((chk_apps_master()) && (*buf == 0x3A)) {
		else if ((len >= sizeof(uint8_t)) && (chk_apps_master()) &&
		(*buf == 0x3A)) {
		/* send response back */
		driver->apps_rsp_buf[0] = *buf;
		diag_send_rsp(driver->apps_rsp_buf, 1, pid);
		@@ -1154,8 +1173,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Check for polling for Apps only DIAG */
		else if ((buf == 0x4b) && ((buf+1) == 0x32) &&
		(*(buf+2) == 0x03)) {
		else if ((len >= (3 * sizeof(uint8_t))) &&
		(buf == 0x4b) && ((buf+1) == 0x32) && (*(buf+2) == 0x03)) {
		/* If no one has registered for polling */
		if (chk_polling_response()) {
		/* Respond to polling for Apps only DIAG */
		@@ -1169,7 +1188,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		}
		}
		/* Return the Delayed Response Wrap Status */
		else if ((buf == 0x4b) && ((buf+1) == 0x32) &&
		else if ((len >= (4 * sizeof(uint8_t))) &&
		(buf == 0x4b) && ((buf+1) == 0x32) &&
		((buf+2) == 0x04) && ((buf+3) == 0x0)) {
		memcpy(driver->apps_rsp_buf, buf, 4);
		driver->apps_rsp_buf[4] = wrap_enabled;
		@@ -1177,7 +1197,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Wrap the Delayed Rsp ID */
		else if ((buf == 0x4b) && ((buf+1) == 0x32) &&
		else if ((len >= (4 * sizeof(uint8_t))) &&
		(buf == 0x4b) && ((buf+1) == 0x32) &&
		((buf+2) == 0x05) && ((buf+3) == 0x0)) {
		wrap_enabled = true;
		memcpy(driver->apps_rsp_buf, buf, 4);
		@@ -1186,7 +1207,8 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* Mobile ID Rsp */
		else if ((*buf == DIAG_CMD_DIAG_SUBSYS) &&
		else if ((len >= (4 * sizeof(uint8_t))) &&
		(*buf == DIAG_CMD_DIAG_SUBSYS) &&
		(*(buf+1) == DIAG_SS_PARAMS) &&
		((buf+2) == DIAG_EXT_MOBILE_ID) && ((buf+3) == 0x0)) {
		write_len = diag_cmd_get_mobile_id(buf, len,
		@@ -1209,7 +1231,7 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		!(driver->diagfwd_cntl[PERIPHERAL_MODEM]->ch_open) &&
		!(driver->feature[PERIPHERAL_MODEM].rcvd_feature_mask)) {
		/* respond to 0x0 command */
		if (*buf == 0x00) {
		if ((len >= sizeof(uint8_t)) && *buf == 0x00) {
		for (i = 0; i < 55; i++)
		driver->apps_rsp_buf[i] = 0;

		@@ -1217,7 +1239,7 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid)
		return 0;
		}
		/* respond to 0x7c command */
		else if (*buf == 0x7c) {
		else if ((len >= sizeof(uint8_t)) && *buf == 0x7c) {
		driver->apps_rsp_buf[0] = 0x7c;
		for (i = 1; i < 8; i++)
		driver->apps_rsp_buf[i] = 0;