Merge "diag: dci: Validate dci client entries prior read" (f8c6ead0) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/diag/diag_dci.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2303,8 +2303,8 @@ struct diag_dci_client_tbl *dci_lookup_client_entry_pid(int tgid)
		pid_struct = find_get_pid(entry->tgid);
		if (!pid_struct) {
		DIAG_LOG(DIAG_DEBUG_DCI,
		"diag: valid pid doesn't exist for pid = %d\n",
		entry->tgid);
		"diag: Exited pid (%d) doesn't match dci client of pid (%d)\n",
		tgid, entry->tgid);
		continue;
		}
		task_s = get_pid_task(pid_struct, PIDTYPE_PID);

+16 −3

Original line number	Diff line number	Diff line
		@@ -534,8 +534,8 @@ static int diagchar_close(struct inode inode, struct file file)
		{
		int ret;

		DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: process exit %s\n",
		current->comm);
		DIAG_LOG(DIAG_DEBUG_USERSPACE, "diag: %s process exit with pid = %d\n",
		current->comm, current->tgid);
		ret = diag_remove_client_entry(file);

		return ret;
		@@ -3390,6 +3390,8 @@ static ssize_t diagchar_read(struct file file, char __user buf, size_t count,
		int exit_stat = 0;
		int write_len = 0;
		struct diag_md_session_t *session_info = NULL;
		struct pid *pid_struct = NULL;
		struct task_struct *task_s = NULL;

		mutex_lock(&driver->diagchar_mutex);
		for (i = 0; i < driver->num_clients; i++)
		@@ -3636,6 +3638,17 @@ static ssize_t diagchar_read(struct file file, char __user buf, size_t count,
		list_for_each_safe(start, temp, &driver->dci_client_list) {
		entry = list_entry(start, struct diag_dci_client_tbl,
		track);
		pid_struct = find_get_pid(entry->tgid);
		if (!pid_struct)
		continue;
		task_s = get_pid_task(pid_struct, PIDTYPE_PID);
		if (!task_s) {
		DIAG_LOG(DIAG_DEBUG_DCI,
		"diag: valid task doesn't exist for pid = %d\n",
		entry->tgid);
		continue;
		}
		if (task_s == entry->client)
		if (entry->client->tgid != current->tgid)
		continue;
		if (!entry->in_service)