Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 29797946 authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

diag: dci: Validate dci client entries prior read 



Validate the dci entries and its task structure before
accessing structure members to prevent copying dci data to
invalid entries.

Change-Id: I07c59ef0705bc52a8268b0dc984ebfa9d26d178e
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 3b3e314b

drivers/char/diag/diag_dci.c

+2 −2
Original line number Diff line number Diff line
@@ -2303,8 +2303,8 @@ struct diag_dci_client_tbl *dci_lookup_client_entry_pid(int tgid) 
		pid_struct = find_get_pid(entry->tgid);

		if (!pid_struct) {

			DIAG_LOG(DIAG_DEBUG_DCI,

				"diag: valid pid doesn't exist for pid = %d\n",

				entry->tgid);

			"diag: Exited pid (%d) doesn't match dci client of pid (%d)\n",

			tgid, entry->tgid);

			continue;

		}

		task_s = get_pid_task(pid_struct, PIDTYPE_PID);

drivers/char/diag/diagchar_core.c

+16 −3
Original line number Diff line number Diff line
@@ -534,8 +534,8 @@ static int diagchar_close(struct inode *inode, struct file *file) 
{

	int ret;



	DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: process exit %s\n",

		current->comm);

	DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: %s process exit with pid = %d\n",

		current->comm, current->tgid);

	ret = diag_remove_client_entry(file);



	return ret;
@@ -3268,6 +3268,8 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, 
	int exit_stat = 0;

	int write_len = 0;

	struct diag_md_session_t *session_info = NULL;

	struct pid *pid_struct = NULL;

	struct task_struct *task_s = NULL;



	mutex_lock(&driver->diagchar_mutex);

	for (i = 0; i < driver->num_clients; i++)
@@ -3514,6 +3516,17 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, 
		list_for_each_safe(start, temp, &driver->dci_client_list) {

			entry = list_entry(start, struct diag_dci_client_tbl,

									track);

			pid_struct = find_get_pid(entry->tgid);

			if (!pid_struct)

				continue;

			task_s = get_pid_task(pid_struct, PIDTYPE_PID);

			if (!task_s) {

				DIAG_LOG(DIAG_DEBUG_DCI,

				"diag: valid task doesn't exist for pid = %d\n",

				entry->tgid);

				continue;

			}

			if (task_s == entry->client)

				if (entry->client->tgid != current->tgid)

					continue;

			if (!entry->in_service)