Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e61cae37 authored by Hardik Arya's avatar Hardik Arya Committed by Gerrit - the friendly Code Review server
Browse files

diag: Check entry table buf status before copying to user 



Check entry table buf status before copying to user

Change-Id: I9029ef9b2c01aead60ae455e8b096d6c09816bd5
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 766f56fd

drivers/char/diag/diag_memorydevice.c

+32 −15
Original line number Diff line number Diff line
@@ -406,8 +406,17 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 


			task_s = get_pid_task(pid_struct, PIDTYPE_PID);

			if (task_s) {



				spin_lock_irqsave(&ch->lock, flags);

				entry = &ch->tbl[j];

				if (entry->len <= 0 || entry->buf == NULL) {

					spin_unlock_irqrestore(&ch->lock,

						flags);

					continue;

				}

				spin_unlock_irqrestore(&ch->lock,

						flags);

				/* Copy the length of data being passed */

				if (entry->len) {

					err = copy_to_user(buf + ret,

							(void *)&(entry->len),

							sizeof(int));
@@ -416,8 +425,10 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
						goto drop_data;

					}

					ret += sizeof(int);

				}



				/* Copy the actual data being passed */

				if (entry->buf) {

					err = copy_to_user(buf + ret,

							(void *)entry->buf,

							entry->len);
@@ -426,6 +437,7 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
						goto drop_data;

					}

					ret += entry->len;

				}

				put_task_struct(task_s);

			}
@@ -437,6 +449,11 @@ int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size, 
			num_data++;

drop_data:

			spin_lock_irqsave(&ch->lock, flags);

			entry = &ch->tbl[j];

			if (entry->len <= 0 || entry->buf == NULL) {

				spin_unlock_irqrestore(&ch->lock, flags);

				continue;

			}

			if (ch->ops && ch->ops->write_done)

				ch->ops->write_done(entry->buf, entry->len,

						    entry->ctx,