Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a6c813a authored by Gopikrishna Mogasati's avatar Gopikrishna Mogasati Committed by Gerrit - the friendly Code Review server
Browse files

diag: Validate memory device client's process descriptor 



This fix checks for valid process descriptor of a
memory device client before exporting information
from diag driver to memory device client's read buffer
for reliable data transfer.

CRs-Fixed: 2016396
Change-Id: I45aeb8fc9e2f6a678d48bbfcbb77c501adbbfce0
Signed-off-by: default avatarGopikrishna Mogasati <gmogas@codeaurora.org>
parent 9c9a0530

drivers/char/diag/diag_memorydevice.c

+37 −16
Original line number Diff line number Diff line
@@ -218,6 +218,7 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
	uint8_t drain_again = 0;

	int peripheral = 0;

	struct diag_md_session_t *session_info = NULL;

	struct pid *pid_struct = NULL;



	for (i = 0; i < NUM_DIAG_MD_DEV && !err; i++) {

		ch = &diag_md[i];
@@ -240,6 +241,14 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
			if ((info && (info->peripheral_mask &

			    MD_PERIPHERAL_MASK(peripheral)) == 0))

				goto drop_data;

			pid_struct = find_get_pid(session_info->pid);

			if (!pid_struct) {

				err = -ESRCH;

				DIAG_LOG(DIAG_DEBUG_PERIPHERALS,

					"diag: No such md_session_map[%d] with pid = %d err=%d exists..\n",

					peripheral, session_info->pid, err);

				goto drop_data;

			}

			/*

			 * If the data is from remote processor, copy the remote

			 * token first
@@ -259,27 +268,35 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
			}

			if (i > 0) {

				remote_token = diag_get_remote(i);

				err = copy_to_user(buf + ret, &remote_token,

				if (get_pid_task(pid_struct, PIDTYPE_PID)) {

					err = copy_to_user(buf + ret,

							&remote_token,

							sizeof(int));

					if (err)

						goto drop_data;

					ret += sizeof(int);

				}

			}



			/* Copy the length of data being passed */

			err = copy_to_user(buf + ret, (void *)&(entry->len),

			if (get_pid_task(pid_struct, PIDTYPE_PID)) {

				err = copy_to_user(buf + ret,

						(void *)&(entry->len),

						sizeof(int));

				if (err)

					goto drop_data;

				ret += sizeof(int);

			}



			/* Copy the actual data being passed */

			err = copy_to_user(buf + ret, (void *)entry->buf,

			if (get_pid_task(pid_struct, PIDTYPE_PID)) {

				err = copy_to_user(buf + ret,

						(void *)entry->buf,

						entry->len);

				if (err)

					goto drop_data;

				ret += entry->len;



			}

			/*

			 * The data is now copied to the user space client,

			 * Notify that the write is complete and delete its
@@ -301,7 +318,11 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
	}



	*pret = ret;

	err = copy_to_user(buf + sizeof(int), (void *)&num_data, sizeof(int));

	if (pid_struct && get_pid_task(pid_struct, PIDTYPE_PID)) {

		err = copy_to_user(buf + sizeof(int),

				(void *)&num_data,

				sizeof(int));

	}

	diag_ws_on_copy_complete(DIAG_WS_MUX);

	if (drain_again)

		chk_logging_wakeup();