Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d2dcc8f authored by Ravi Aravamudhan's avatar Ravi Aravamudhan
Browse files

diag: Fix issue with accessing reallocated buffer 



Diag driver reallocates its buffer when the data read from SMD is
greater than IN_BUF_SIZE. It uses the old pointer even after
reallocating the buffer resulting in dangling pointer access. This
patch fixes this issue.

Change-Id: I21322f161df51accd0464a47ab0cf469fbb2959f
Signed-off-by: default avatarRavi Aravamudhan <aravamud@codeaurora.org>
parent bb047aa5

drivers/char/diag/diagfwd.c

+11 −7
Original line number Diff line number Diff line
@@ -323,6 +323,8 @@ static int check_bufsize_for_encoding(struct diag_smd_info *smd_info, void *buf, 
				if (temp_buf) {

					smd_info->buf_in_1 = temp_buf;

					smd_info->buf_in_1_size = max_size;

				} else {

					return -ENOMEM;

				}

			}

			buf_size = smd_info->buf_in_1_size;
@@ -334,6 +336,8 @@ static int check_bufsize_for_encoding(struct diag_smd_info *smd_info, void *buf, 
				if (temp_buf) {

					smd_info->buf_in_2 = temp_buf;

					smd_info->buf_in_2_size = max_size;

				} else {

					return -ENOMEM;

				}

			}

			buf_size = smd_info->buf_in_2_size;
@@ -384,6 +388,10 @@ int diag_process_smd_read_data(struct diag_smd_info *smd_info, void *buf, 
		success = 1;

	} else {

		/* The data is raw and needs to be hdlc encoded */

		write_length = check_bufsize_for_encoding(smd_info, buf,

							  total_recd);

		if (write_length < 0)

			return write_length;

		if (smd_info->buf_in_1_raw == buf) {

			write_buf = smd_info->buf_in_1;

			in_busy_ptr = &smd_info->in_busy_1;
@@ -397,14 +405,10 @@ int diag_process_smd_read_data(struct diag_smd_info *smd_info, void *buf, 
				__func__, smd_info->peripheral);

			return -EIO;

		}

		write_length = check_bufsize_for_encoding(smd_info, buf,

							  total_recd);

		if (write_length) {

		success = diag_add_hdlc_encoding(smd_info, buf,

						 total_recd, write_buf,

						 &write_length);

	}

	}



	if (!success) {

		pr_err_ratelimited("diag: smd data write unsuccessful, success: %d\n",