Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb1846d3 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Fix possible uninitialized and out-of-bound access"

parents 0b8e7590 e7099040

drivers/char/diag/diag_masks.c

+44 −43
Original line number Diff line number Diff line
@@ -135,8 +135,8 @@ static void diag_send_log_mask_update(uint8_t peripheral, 
	int err = 0, send_once = 0, i;

	int header_len = sizeof(struct diag_ctrl_log_mask);

	uint8_t *buf = NULL, *temp = NULL;

	uint8_t upd = 0, status;

	uint32_t mask_size = 0, pd_mask = 0;

	uint8_t upd = 0, status, eq_id;

	uint32_t mask_size = 0, pd_mask = 0, num_items = 0;

	struct diag_ctrl_log_mask ctrl_pkt;

	struct diag_ctrl_log_mask_sub ctrl_pkt_sub;

	struct diag_mask_info *mask_info = NULL;
@@ -197,46 +197,42 @@ static void diag_send_log_mask_update(uint8_t peripheral, 
		goto err;

	buf = mask_info->update_buf;



	for (i = 0; i < MAX_EQUIP_ID; i++, mask++) {

		if (!mask->ptr)

			continue;



		if (equip_id != i && equip_id != ALL_EQUIP_ID)

			continue;



		mutex_lock(&mask->lock);

		switch (status) {

		case DIAG_CTRL_MASK_ALL_DISABLED:

		case DIAG_CTRL_MASK_ALL_ENABLED:

		ctrl_pkt.equip_id = 0;

		ctrl_pkt.num_items = 0;

		ctrl_pkt.log_mask_size = 0;

			eq_id = 0;

			num_items = 0;

			mask_size = 0;

			send_once = 1;

			break;

		case DIAG_CTRL_MASK_VALID:

		send_once = 0;

			mask_size = LOG_ITEMS_TO_SIZE(mask->num_items_tools);

			eq_id = i;

			num_items = mask->num_items_tools;

			break;

		default:

		pr_debug("diag: In %s, invalid log_mask status\n", __func__);

			pr_debug("diag: In %s, invalid log_mask status\n",

				__func__);

			mutex_unlock(&mask->lock);

			return;

		}



	for (i = 0; i < MAX_EQUIP_ID; i++, mask++) {

		if (!mask->ptr)

			continue;



		if (equip_id != i && equip_id != ALL_EQUIP_ID)

			continue;



		mutex_lock(&mask->lock);

		if (sub_index >= 0 && preset_id > 0)

			goto proceed_sub_pkt;



		ctrl_pkt.cmd_type = DIAG_CTRL_MSG_LOG_MASK;

		ctrl_pkt.stream_id = 1;

		ctrl_pkt.status = mask_info->status;

		if (mask_info->status == DIAG_CTRL_MASK_VALID) {

			mask_size = LOG_ITEMS_TO_SIZE(mask->num_items_tools);

			ctrl_pkt.equip_id = i;

			ctrl_pkt.num_items = mask->num_items_tools;

		ctrl_pkt.equip_id = eq_id;

		ctrl_pkt.num_items = num_items;

		ctrl_pkt.log_mask_size = mask_size;

		} else {

			ctrl_pkt.equip_id = 0;

			ctrl_pkt.num_items = 0;

			ctrl_pkt.log_mask_size = 0;

		}

		ctrl_pkt.data_len = LOG_MASK_CTRL_HEADER_LEN + mask_size;

		header_len = sizeof(struct diag_ctrl_msg_mask);

		goto send_cntrl_pkt;
@@ -253,16 +249,9 @@ static void diag_send_log_mask_update(uint8_t peripheral, 
		}

		ctrl_pkt_sub.stream_id = 1;

		ctrl_pkt_sub.status = status;

		if (status == DIAG_CTRL_MASK_VALID) {

			mask_size = LOG_ITEMS_TO_SIZE(mask->num_items_tools);

			ctrl_pkt_sub.equip_id = i;

			ctrl_pkt_sub.num_items = mask->num_items_tools;

		ctrl_pkt_sub.equip_id = eq_id;

		ctrl_pkt_sub.num_items = num_items;

		ctrl_pkt_sub.log_mask_size = mask_size;

		} else {

			ctrl_pkt_sub.equip_id = 0;

			ctrl_pkt_sub.num_items = 0;

			ctrl_pkt_sub.log_mask_size = 0;

		}

		ctrl_pkt_sub.data_len = LOG_MASK_CTRL_HEADER_LEN_SUB +

			mask_size;

		header_len = sizeof(struct diag_ctrl_msg_mask_sub);
@@ -291,9 +280,9 @@ static void diag_send_log_mask_update(uint8_t peripheral, 
		mutex_unlock(&mask->lock);



		DIAG_LOG(DIAG_DEBUG_MASKS,

			 "sending ctrl pkt to %d, e %d num_items %d size %d\n",

			 peripheral, i, ctrl_pkt.num_items,

			 ctrl_pkt.log_mask_size);

			 "sending ctrl pkt to %d, equip_id %d num_items %d size %d\n",

			 peripheral, eq_id, num_items,

			 mask_size);



		err = diagfwd_write(peripheral, TYPE_CNTL,

				    buf, header_len + mask_size);
@@ -616,7 +605,7 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last, 
		header.msg_mask_size = mask_size;

		mask_size *= sizeof(uint32_t);

		header.data_len = MSG_MASK_CTRL_HEADER_LEN + mask_size;

		memcpy(buf, &header, header_len);

		memcpy(buf, &header, sizeof(header));

		if (mask_size > 0)

			memcpy(buf + header_len, mask->ptr, mask_size);

		mutex_unlock(&mask->lock);
@@ -651,7 +640,7 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last, 
		header_sub.msg_mask_size = mask_size;

		mask_size *= sizeof(uint32_t);

		header_sub.data_len = MSG_MASK_CTRL_HEADER_LEN_SUB + mask_size;

		memcpy(buf, &header_sub, header_len);

		memcpy(buf, &header_sub, sizeof(header_sub));

		if (mask_size > 0)

			memcpy(buf + header_len, mask->ptr, mask_size);

		mutex_unlock(&mask->lock);
@@ -1234,6 +1223,8 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;
@@ -1365,6 +1356,8 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;
@@ -1557,6 +1550,8 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;
@@ -1662,6 +1657,8 @@ static int diag_cmd_toggle_events(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;
@@ -2088,6 +2085,8 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;
@@ -2203,6 +2202,8 @@ static int diag_cmd_disable_log_mask(unsigned char *src_buf, int src_len, 
			peripheral = diag_search_peripheral_by_pd(i);

		else

			peripheral = i;

		if (peripheral < 0 || peripheral >= NUM_PERIPHERALS)

			continue;

		if (sub_index >= 0 &&

			!driver->feature[peripheral].multi_sim_support)

			continue;