Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d8c26e52 authored by Katish Paran's avatar Katish Paran
Browse files

diag: Check for valid proc id while querying real time status 



Currently in diag driver invalid proc id may lead to accessing
invalid array elements. This patch fixes the issue.

Change-Id: I4bcf3eb610537c589d0b66903df1e79a88127b93
CRs-fixed: 629864
Signed-off-by: default avatarKatish Paran <kparan@codeaurora.org>
parent 2c227c65

drivers/char/diag/diag_dci.c

+12 −9
Original line number Diff line number Diff line
@@ -2709,8 +2709,10 @@ fail_alloc: 
	if (new_entry) {

		for (i = 0; i < new_entry->num_buffers; i++) {

			proc_buf = &new_entry->buffers[i];

			if (proc_buf) {

				mutex_destroy(&proc_buf->health_mutex);

			mutex_destroy(&proc_buf->buf_primary->data_mutex);

				mutex_destroy(

					&proc_buf->buf_primary->data_mutex);

				mutex_destroy(&proc_buf->buf_cmd->data_mutex);

				if (proc_buf->buf_primary)

					kfree(proc_buf->buf_primary->data);
@@ -2719,6 +2721,7 @@ fail_alloc: 
					kfree(proc_buf->buf_cmd->data);

				kfree(proc_buf->buf_cmd);

			}

		}

		kfree(new_entry->dci_event_mask);

		kfree(new_entry->dci_log_mask);

	}

drivers/char/diag/diagchar_core.c

+1 −1
Original line number Diff line number Diff line
@@ -1085,7 +1085,7 @@ static int diag_ioctl_get_real_time(unsigned long ioarg) 
				usleep_range(10000, 10100);

		} else {

			if (rt_query.proc < 0 ||

					rt_query.proc > DIAG_NUM_PROC) {

					rt_query.proc >= DIAG_NUM_PROC) {

				pr_err("diag: Invalid proc %d in %s\n",

				       rt_query.proc, __func__);

				return -EINVAL;