Merge "diag: Check entry table buf status before copying to user" (375fcf31) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/char/diag/diag_memorydevice.c

+32 −15

Original line number	Diff line number	Diff line
		@@ -406,8 +406,17 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,

		task_s = get_pid_task(pid_struct, PIDTYPE_PID);
		if (task_s) {

		spin_lock_irqsave(&ch->lock, flags);
		entry = &ch->tbl[j];
		if (entry->len <= 0 \|\| entry->buf == NULL) {
		spin_unlock_irqrestore(&ch->lock,
		flags);
		continue;
		}
		spin_unlock_irqrestore(&ch->lock,
		flags);
		/* Copy the length of data being passed */
		if (entry->len) {
		err = copy_to_user(buf + ret,
		(void *)&(entry->len),
		sizeof(int));
		@@ -416,8 +425,10 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
		goto drop_data;
		}
		ret += sizeof(int);
		}

		/* Copy the actual data being passed */
		if (entry->buf) {
		err = copy_to_user(buf + ret,
		(void *)entry->buf,
		entry->len);
		@@ -426,6 +437,7 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
		goto drop_data;
		}
		ret += entry->len;
		}
		put_task_struct(task_s);
		}

		@@ -437,6 +449,11 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
		num_data++;
		drop_data:
		spin_lock_irqsave(&ch->lock, flags);
		entry = &ch->tbl[j];
		if (entry->len <= 0 \|\| entry->buf == NULL) {
		spin_unlock_irqrestore(&ch->lock, flags);
		continue;
		}
		if (ch->ops && ch->ops->write_done)
		ch->ops->write_done(entry->buf, entry->len,
		entry->ctx,