Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5b9bc8cf authored by Hardik Arya's avatar Hardik Arya
Browse files

diag: Prevent out-of-bound access while processing non-hdlc pkt 



While parsing non-hdlc packet buffer length passed to hdlc
recovery is not updated after parsing partial packet, Which
can lead to out-of-bound access. The patch passes the updated
buffer length for the same.

Change-Id: I5596f8c5a72680684c9c9056dccaf33e3c36832c
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent 16f99f5f

drivers/char/diag/diagfwd.c

+5 −5
Original line number Diff line number Diff line
@@ -1745,7 +1745,7 @@ void diag_process_non_hdlc_pkt(unsigned char *buf, int len, int pid) 
		if (*(uint8_t *)(data_ptr + actual_pkt->length) !=

						CONTROL_CHAR) {

			mutex_unlock(&driver->hdlc_recovery_mutex);

			diag_hdlc_start_recovery(buf, len, pid);

			diag_hdlc_start_recovery(buf, (len - read_bytes), pid);

			mutex_lock(&driver->hdlc_recovery_mutex);

		}

		err = diag_process_apps_pkt(data_ptr,
@@ -1771,8 +1771,8 @@ void diag_process_non_hdlc_pkt(unsigned char *buf, int len, int pid) 
		pkt_len = actual_pkt->length;



		if (actual_pkt->start != CONTROL_CHAR) {

			diag_hdlc_start_recovery(buf, len, pid);

			diag_send_error_rsp(buf, len, pid);

			diag_hdlc_start_recovery(buf, (len - read_bytes), pid);

			diag_send_error_rsp(buf, (len - read_bytes), pid);

			goto end;

		}

		mutex_lock(&driver->hdlc_recovery_mutex);
@@ -1780,7 +1780,7 @@ void diag_process_non_hdlc_pkt(unsigned char *buf, int len, int pid) 
			pr_err("diag: In %s, incoming data is too large for the request buffer %d\n",

			       __func__, pkt_len);

			mutex_unlock(&driver->hdlc_recovery_mutex);

			diag_hdlc_start_recovery(buf, len, pid);

			diag_hdlc_start_recovery(buf, (len - read_bytes), pid);

			break;

		}

		if ((pkt_len + header_len) > (len - read_bytes)) {
@@ -1797,7 +1797,7 @@ void diag_process_non_hdlc_pkt(unsigned char *buf, int len, int pid) 
		if (*(uint8_t *)(data_ptr + actual_pkt->length) !=

						CONTROL_CHAR) {

			mutex_unlock(&driver->hdlc_recovery_mutex);

			diag_hdlc_start_recovery(buf, len, pid);

			diag_hdlc_start_recovery(buf, (len - read_bytes), pid);

			mutex_lock(&driver->hdlc_recovery_mutex);

		}

		else