Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 680ad7a2 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Properly reallocate dci cmd response buffer"

parents c17813fa 8272340e

drivers/char/diag/diag_dci.c

+11 −9
Original line number Diff line number Diff line
@@ -1006,6 +1006,7 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source, 
	unsigned char *temp = buf;

	int save_req_uid = 0;

	struct diag_dci_pkt_rsp_header_t pkt_rsp_header;

	int header_len = sizeof(struct diag_dci_pkt_rsp_header_t);



	if (!buf || len <= 0) {

		pr_err("diag: Invalid pointer in %s\n", __func__);
@@ -1074,14 +1075,12 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source, 
	mutex_lock(&rsp_buf->data_mutex);

	/*

	 * Check if we can fit the data in the rsp buffer. The total length of

	 * the rsp is the rsp length (write_len) + DCI_PKT_RSP_TYPE header (int)

	 * + field for length (int) + delete_flag (uint8_t)

	 * the rsp is the rsp length (write_len) + dci response packet header

	 * length (sizeof(struct diag_dci_pkt_rsp_header_t))

	 */

	if ((rsp_buf->data_len + 9 + rsp_len) > rsp_buf->capacity) {

	if ((rsp_buf->data_len + header_len + rsp_len) > rsp_buf->capacity) {

		pr_alert("diag: create capacity for pkt rsp\n");

		rsp_buf->capacity += 9 + rsp_len;

		temp_buf = krealloc(rsp_buf->data, rsp_buf->capacity,

				    GFP_KERNEL);

		temp_buf = vzalloc(rsp_buf->capacity + header_len + rsp_len);

		if (!temp_buf) {

			pr_err("diag: DCI realloc failed\n");

			mutex_unlock(&rsp_buf->data_mutex);
@@ -1089,6 +1088,10 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source, 
			mutex_unlock(&driver->dci_mutex);

			return;

		}

		rsp_buf->capacity += header_len + rsp_len;

		if (rsp_buf->capacity > rsp_buf->data_len)

			memcpy(temp_buf, rsp_buf->data, rsp_buf->data_len);

		vfree(rsp_buf->data);

		rsp_buf->data = temp_buf;

	}
@@ -1098,9 +1101,8 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source, 
	pkt_rsp_header.length = rsp_len + sizeof(int);

	pkt_rsp_header.delete_flag = delete_flag;

	pkt_rsp_header.uid = save_req_uid;

	memcpy(rsp_buf->data + rsp_buf->data_len, &pkt_rsp_header,

		sizeof(struct diag_dci_pkt_rsp_header_t));

	rsp_buf->data_len += sizeof(struct diag_dci_pkt_rsp_header_t);

	memcpy(rsp_buf->data + rsp_buf->data_len, &pkt_rsp_header, header_len);

	rsp_buf->data_len += header_len;

	memcpy(rsp_buf->data + rsp_buf->data_len, temp, rsp_len);

	rsp_buf->data_len += rsp_len;

	rsp_buf->data_source = data_source;