Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 15f079d1 authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Use correct size while reallocating for hdlc encoding 



Possibility of mismatch with realloc size against the buf size
can cause out of bound scenario. Prevent the same using
proper size for reallocation of hdlc encoding.

Change-Id: I0c0f822bc591af69b009967c89d378ac70f79678
Signed-off-by: default avatarManoj Prabhu B <quic_bmanoj@quicinc.com>
parent a4238be0

drivers/char/diag/diagfwd_peripheral.c

+10 −9
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2015-2019, 2021, The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 */

#include <linux/slab.h>

#include <linux/err.h>
@@ -179,7 +180,7 @@ static int diag_add_hdlc_encoding(unsigned char *dest_buf, int *dest_len, 
static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)

{

	int i, ctx = 0, flag_64k = 0;

	uint32_t max_size = 0;

	uint32_t max_size = 0, realloc_len = 0;

	unsigned long flags;

	unsigned char *temp_buf = NULL;

	struct diag_md_info *ch = NULL;
@@ -223,20 +224,20 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len) 
				}

				spin_unlock_irqrestore(&ch->lock, flags);

			}

			temp_buf = krealloc(buf->data, max_size +

						APF_DIAG_PADDING,



			if (flag_64k)

				realloc_len = MAX_PERIPHERAL_HDLC_BUF_SZ;

			else

				realloc_len = MAX_PERIPHERAL_BUF_SZ;



			temp_buf = krealloc(buf->data, realloc_len,

					    GFP_KERNEL);

			if (!temp_buf) {

				mutex_unlock(&driver->md_session_lock);

				return -ENOMEM;

			}

			buf->data = temp_buf;



			if (flag_64k)

				buf->len = MAX_PERIPHERAL_HDLC_BUF_SZ;

			else

				buf->len = MAX_PERIPHERAL_BUF_SZ;



			buf->len = realloc_len;

			DIAG_LOG(DIAG_DEBUG_PERIPHERALS,

			"diag: Reallocated data buffer: %pK with size: %d, max_buf_len: %d, p: %d, t: %d, n: %d\n",

			temp_buf, max_size, buf->len,