Merge "msm:ipa_v3: Fixed buffer overflow issue" (4bde98c8) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/platform/msm/ipa/ipa_v3/ipa_debugfs.c

+27 −17

Original line number	Diff line number	Diff line
		/* Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -32,6 +32,8 @@
		#define IPA_READ_WRITE_MODE 0664
		#define IPA_WRITE_ONLY_MODE 0220

		#define DEBUG_BUF_MAX_LEN(nbytes) (nbytes < IPA_MAX_MSG_LEN ? 1 : 0)

		struct ipa3_debugfs_file {
		const char *name;
		umode_t mode;
		@@ -392,26 +394,34 @@ static ssize_t ipa3_read_hdr(struct file file, char __user ubuf, size_t count,
		ipa3_hdr_l2_type_name[entry->type]);

		if (entry->is_hdr_proc_ctx) {
		if (DEBUG_BUF_MAX_LEN(nbytes)) {
		nbytes += scnprintf(
		dbg_buff + nbytes,
		IPA_MAX_MSG_LEN - nbytes,
		"phys_base=0x%pa ",
		&entry->phys_base);
		}
		} else {
		if (DEBUG_BUF_MAX_LEN(nbytes)) {
		nbytes += scnprintf(
		dbg_buff + nbytes,
		IPA_MAX_MSG_LEN - nbytes,
		"ofst=%u ",
		entry->offset_entry->offset >> 2);
		}
		}
		for (i = 0; i < entry->hdr_len; i++) {
		if (DEBUG_BUF_MAX_LEN(nbytes + i * 2)) {
		scnprintf(dbg_buff + nbytes + i * 2,
		IPA_MAX_MSG_LEN - nbytes - i * 2,
		"%02x", entry->hdr[i]);
		}
		}
		if (DEBUG_BUF_MAX_LEN(nbytes + entry->hdr_len * 2)) {
		scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,
		IPA_MAX_MSG_LEN - nbytes - entry->hdr_len * 2,
		"\n");
		}
		pr_err("%s", dbg_buff);
		}
		mutex_unlock(&ipa3_ctx->lock);

+6 −4

Original line number	Diff line number	Diff line
		/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -439,11 +439,13 @@ static ssize_t ipa_ut_dbgfs_meta_test_read(struct file *file,
		for (i = 0 ; i < suite->tests_cnt ; i++) {
		if (!suite->tests[i].run_in_regression)
		continue;
		if (nbytes < IPA_UT_DEBUG_READ_BUF_SIZE) {
		nbytes += scnprintf(buf + nbytes,
		IPA_UT_DEBUG_READ_BUF_SIZE - nbytes,
		"\t\t%s\n", suite->tests[i].name);
		}
		}
		}

		cnt = simple_read_from_buffer(ubuf, count, ppos, buf, nbytes);
		kfree(buf);