Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ad548062 authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Ensure dci entry is valid before sending the packet 



Possibility of a race condition which can free the dci entry
causing use after free case is prevented by adding the check
for entry's validity.

Change-Id: Ib436ffd16c266636d99885d6091eb1a6887737c7
Signed-off-by: default avatarManoj Prabhu B <quic_bmanoj@quicinc.com>
parent cb8002c8

drivers/char/diag/diag_dci.c

+5 −5
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2022, The Linux Foundation. All rights reserved.

 */



#include <linux/slab.h>
@@ -1625,7 +1625,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		return -EIO;

	}



	mutex_lock(&driver->dci_mutex);

	/* prepare DCI packet */

	header.start = CONTROL_CHAR;

	header.version = 1;
@@ -1644,7 +1643,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		diag_update_pkt_buffer(driver->apps_dci_buf, write_len,

				       DCI_PKT_TYPE);

		diag_update_sleeping_process(entry->pid, DCI_PKT_TYPE);

		mutex_unlock(&driver->dci_mutex);

		return DIAG_DCI_NO_ERROR;

	}
@@ -1664,7 +1662,6 @@ static int diag_send_dci_pkt(struct diag_cmd_reg_t *entry, 
		       entry->proc);

		status = DIAG_DCI_SEND_DATA_FAIL;

	}

	mutex_unlock(&driver->dci_mutex);

	return status;

}
@@ -2136,8 +2133,11 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	if (temp_entry) {

		reg_item = container_of(temp_entry, struct diag_cmd_reg_t,

								entry);

		mutex_lock(&driver->dci_mutex);

		if (req_entry)

			ret = diag_send_dci_pkt(reg_item, req_buf, req_len,

					req_entry->tag);

		mutex_unlock(&driver->dci_mutex);

	} else {

		DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",

				reg_entry.cmd_code, reg_entry.subsys_id,