Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 989c76bb authored by Hardik Arya's avatar Hardik Arya Committed by Gerrit - the friendly Code Review server
Browse files

diag: Prevent out-of-bound access while processing stm cmd 



Proper buffer length check is missing before processing
stm cmd, which can lead to out-of-bound access. The patch
adds proper check for the same.

Change-Id: I57ad12166704eb69cceff27ac73d1a59300b3e79
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent 2e230aee

drivers/char/diag/diag_dci.c

+2 −1
Original line number Diff line number Diff line
@@ -1878,7 +1878,8 @@ static int diag_dci_process_apps_pkt(struct diag_pkt_header_t *pkt_header, 
							DIAG_MAX_REQ_SIZE;

			write_len += sizeof(uint32_t);

		} else if (ss_cmd_code == DIAG_DIAG_STM) {

			write_len = diag_process_stm_cmd(req_buf, payload_ptr);

			write_len = diag_process_stm_cmd(req_buf, req_len,

				payload_ptr);

		}

	} else if (subsys_id == DIAG_SS_PARAMS) {

		if (ss_cmd_code == DIAG_DIAG_POLL) {

drivers/char/diag/diagfwd.c

+11 −6
Original line number Diff line number Diff line
@@ -591,7 +591,7 @@ void diag_process_stm_mask(uint8_t cmd, uint8_t data_mask, int data_type) 
	}

}



int diag_process_stm_cmd(unsigned char *buf, unsigned char *dest_buf)

int diag_process_stm_cmd(unsigned char *buf, int len, unsigned char *dest_buf)

{

	uint8_t version, mask, cmd;

	uint8_t rsp_supported = 0;
@@ -603,7 +603,11 @@ int diag_process_stm_cmd(unsigned char *buf, unsigned char *dest_buf) 
		       buf, dest_buf, __func__);

		return -EIO;

	}



	if (len < STM_CMD_NUM_BYTES) {

		pr_err("diag: Invalid buffer length: %d in %s\n", len,

			__func__);

		return -EINVAL;

	}

	version = *(buf + STM_CMD_VERSION_OFFSET);

	mask = *(buf + STM_CMD_MASK_OFFSET);

	cmd = *(buf + STM_CMD_DATA_OFFSET);
@@ -1118,12 +1122,13 @@ int diag_process_apps_pkt(unsigned char *buf, int len, int pid) 
	} else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&

		(*buf == 0x4b) && (*(buf+1) == 0x12) &&

		(*(uint16_t *)(buf+2) == DIAG_DIAG_STM)) {

		len = diag_process_stm_cmd(buf, driver->apps_rsp_buf);

		if (len > 0) {

			diag_send_rsp(driver->apps_rsp_buf, len, pid);

		write_len = diag_process_stm_cmd(buf, len,

			driver->apps_rsp_buf);

		if (write_len > 0) {

			diag_send_rsp(driver->apps_rsp_buf, write_len, pid);

			return 0;

		}

		return len;

		return write_len;

	}

	/* Check for time sync query command */

	else if ((len >= ((2 * sizeof(uint8_t)) + sizeof(uint16_t))) &&

drivers/char/diag/diagfwd.h

+2 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2008-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2008-2017, 2019 The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -46,7 +46,7 @@ void diag_update_sleeping_process(int process_id, int data_type); 
int diag_process_apps_pkt(unsigned char *buf, int len, int pid);

void diag_send_error_rsp(unsigned char *buf, int len, int pid);

void diag_update_pkt_buffer(unsigned char *buf, uint32_t len, int type);

int diag_process_stm_cmd(unsigned char *buf, unsigned char *dest_buf);

int diag_process_stm_cmd(unsigned char *buf, int len, unsigned char *dest_buf);

void diag_md_hdlc_reset_timer_func(unsigned long pid);

void diag_update_md_clients(unsigned int type);

#endif