Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82173db0 authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Validate the dci client before sending dci packet 



Ensure dci client's tag used is a valid one by validating against
its status before sending the dci packet to client.

Change-Id: Ia673e8b548e441eb907820dc395c22b7f1b75d10
Signed-off-by: default avatarManoj Prabhu B <quic_bmanoj@quicinc.com>
parent ad548062

drivers/char/diag/diag_dci.c

+10 −5
Original line number Diff line number Diff line
@@ -1986,12 +1986,13 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
{

	int ret = DIAG_DCI_TABLE_ERR;

	int common_cmd = 0, header_len = 0;

	int req_tag = 0;

	struct diag_pkt_header_t *header = NULL;

	unsigned char *temp = buf;

	unsigned char *req_buf = NULL;

	uint8_t retry_count = 0, max_retries = 3;

	uint32_t read_len = 0, req_len = len;

	struct dci_pkt_req_entry_t *req_entry = NULL;

	struct dci_pkt_req_entry_t *req_entry = NULL, *test_entry = NULL;

	struct diag_dci_client_tbl *dci_entry = NULL;

	struct dci_pkt_req_t req_hdr;

	struct diag_cmd_reg_t *reg_item;
@@ -2096,6 +2097,7 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
		mutex_unlock(&driver->dci_mutex);

		return DIAG_DCI_NO_REG;

	}

	req_tag = req_entry->tag;

	mutex_unlock(&driver->dci_mutex);



	/*
@@ -2103,14 +2105,14 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
	 * remote processor

	 */

	if (dci_entry->client_info.token > 0) {

		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_entry->tag,

		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_tag,

					       dci_entry->client_info.token);

		return ret;

	}



	/* Check if it is a dedicated Apps command */

	ret = diag_dci_process_apps_pkt(header, req_buf, req_len,

					req_entry->tag, header_len);

					req_tag, header_len);

	if ((ret == DIAG_DCI_NO_ERROR && !common_cmd) || ret < 0)

		return ret;
@@ -2134,9 +2136,12 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len) 
		reg_item = container_of(temp_entry, struct diag_cmd_reg_t,

								entry);

		mutex_lock(&driver->dci_mutex);

		if (req_entry)

		test_entry = diag_dci_get_request_entry(req_tag);

		if (test_entry)

			ret = diag_send_dci_pkt(reg_item, req_buf, req_len,

					req_entry->tag);

					test_entry->tag);

		else

			ret = -EIO;

		mutex_unlock(&driver->dci_mutex);

	} else {

		DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",