Merge "diag: Protect md_info structure while reallocation" (60b5dfe5) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/char/diag/diag_memorydevice.c

+7 −3

Original line number	Diff line number	Diff line
		@@ -160,11 +160,12 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx)
		return -EIO;
		}
		pid = session_info->pid;
		mutex_unlock(&driver->md_session_lock);

		ch = &diag_md[id];
		if (!ch \|\| !ch->md_info_inited)
		if (!ch \|\| !ch->md_info_inited) {
		mutex_unlock(&driver->md_session_lock);
		return -EINVAL;
		}

		spin_lock_irqsave(&ch->lock, flags);
		for (i = 0; i < ch->num_tbl_entries && !found; i++) {
		@@ -180,8 +181,10 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx)
		}
		spin_unlock_irqrestore(&ch->lock, flags);

		if (found)
		if (found) {
		mutex_unlock(&driver->md_session_lock);
		return -ENOMEM;
		}

		spin_lock_irqsave(&ch->lock, flags);
		for (i = 0; i < ch->num_tbl_entries && !found; i++) {
		@@ -194,6 +197,7 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx)
		}
		}
		spin_unlock_irqrestore(&ch->lock, flags);
		mutex_unlock(&driver->md_session_lock);

		if (!found) {
		pr_err_ratelimited("diag: Unable to find an empty space in table, please reduce logging rate, proc: %d\n",

+13 −3

Original line number	Diff line number	Diff line
		@@ -188,6 +188,7 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
		{
		int i, ctx = 0;
		uint32_t max_size = 0;
		unsigned long flags;
		unsigned char *temp_buf = NULL;
		struct diag_md_info *ch = NULL;

		@@ -202,12 +203,17 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
		max_size = MAX_PERIPHERAL_HDLC_BUF_SZ;
		}

		mutex_lock(&driver->md_session_lock);
		if (buf->len < max_size) {
		if (driver->logging_mode == DIAG_MEMORY_DEVICE_MODE \|\|
		driver->logging_mode == DIAG_MULTI_MODE) {
		ch = &diag_md[DIAG_LOCAL_PROC];
		for (i = 0; ch != NULL &&
		i < ch->num_tbl_entries; i++) {
		if (!ch \|\| !ch->md_info_inited) {
		mutex_unlock(&driver->md_session_lock);
		return -EINVAL;
		}
		spin_lock_irqsave(&ch->lock, flags);
		for (i = 0; i < ch->num_tbl_entries; i++) {
		if (ch->tbl[i].buf == buf->data) {
		ctx = ch->tbl[i].ctx;
		ch->tbl[i].buf = NULL;
		@@ -220,18 +226,22 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
		break;
		}
		}
		spin_unlock_irqrestore(&ch->lock, flags);
		}
		temp_buf = krealloc(buf->data, max_size +
		APF_DIAG_PADDING,
		GFP_KERNEL);
		if (!temp_buf)
		if (!temp_buf) {
		mutex_unlock(&driver->md_session_lock);
		return -ENOMEM;
		}
		DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
		"Reallocated data buffer: %pK with size: %d\n",
		temp_buf, max_size);
		buf->data = temp_buf;
		buf->len = max_size;
		}
		mutex_unlock(&driver->md_session_lock);
		}

		return buf->len;