Merge "diag: Validate memory device client's process descriptor" (932034e5) · Commits · e / devices / android_kernel_sony_msm8998

drivers/char/diag/diag_memorydevice.c

+41 −16

Original line number	Original line	Diff line number	Diff line
	@@ -252,6 +252,7 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
	uint8_t drain_again = 0;		uint8_t drain_again = 0;
	uint8_t peripheral = 0;		uint8_t peripheral = 0;
	struct diag_md_session_t *session_info = NULL;		struct diag_md_session_t *session_info = NULL;
			struct pid *pid_struct = NULL;

	mutex_lock(&driver->diagfwd_untag_mutex);		mutex_lock(&driver->diagfwd_untag_mutex);

	@@ -278,6 +279,14 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
	if ((info && (info->peripheral_mask &		if ((info && (info->peripheral_mask &
	MD_PERIPHERAL_MASK(peripheral)) == 0))		MD_PERIPHERAL_MASK(peripheral)) == 0))
	goto drop_data;		goto drop_data;
			pid_struct = find_get_pid(session_info->pid);
			if (!pid_struct) {
			err = -ESRCH;
			DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
			"diag: No such md_session_map[%d] with pid = %d err=%d exists..\n",
			peripheral, session_info->pid, err);
			goto drop_data;
			}
	/*		/*
	* If the data is from remote processor, copy the remote		* If the data is from remote processor, copy the remote
	* token first		* token first
	@@ -297,27 +306,35 @@ int diag_md_copy_to_user(char __user buf, int pret, size_t buf_size,
	}		}
	if (i > 0) {		if (i > 0) {
	remote_token = diag_get_remote(i);		remote_token = diag_get_remote(i);
	err = copy_to_user(buf + ret, &remote_token,		if (get_pid_task(pid_struct, PIDTYPE_PID)) {
			err = copy_to_user(buf + ret,
			&remote_token,
	sizeof(int));		sizeof(int));
	if (err)		if (err)
	goto drop_data;		goto drop_data;
	ret += sizeof(int);		ret += sizeof(int);
	}		}
			}

	/* Copy the length of data being passed */		/* Copy the length of data being passed */
	err = copy_to_user(buf + ret, (void *)&(entry->len),		if (get_pid_task(pid_struct, PIDTYPE_PID)) {
			err = copy_to_user(buf + ret,
			(void *)&(entry->len),
	sizeof(int));		sizeof(int));
	if (err)		if (err)
	goto drop_data;		goto drop_data;
	ret += sizeof(int);		ret += sizeof(int);
			}

	/* Copy the actual data being passed */		/* Copy the actual data being passed */
	err = copy_to_user(buf + ret, (void *)entry->buf,		if (get_pid_task(pid_struct, PIDTYPE_PID)) {
			err = copy_to_user(buf + ret,
			(void *)entry->buf,
	entry->len);		entry->len);
	if (err)		if (err)
	goto drop_data;		goto drop_data;
	ret += entry->len;		ret += entry->len;
			}
	/*		/*
	* The data is now copied to the user space client,		* The data is now copied to the user space client,
	* Notify that the write is complete and delete its		* Notify that the write is complete and delete its
	@@ -339,7 +356,15 @@ drop_data:
	}		}

	*pret = ret;		*pret = ret;
	err = copy_to_user(buf + sizeof(int), (void *)&num_data, sizeof(int));		if (pid_struct && get_pid_task(pid_struct, PIDTYPE_PID)) {
			err = copy_to_user(buf + sizeof(int),
			(void *)&num_data,
			sizeof(int));
			} else {
			DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
			"diag: md_session_map[%d] with pid = %d Exited..\n",
			peripheral, driver->md_session_map[peripheral]->pid);
			}
	diag_ws_on_copy_complete(DIAG_WS_MUX);		diag_ws_on_copy_complete(DIAG_WS_MUX);
	if (drain_again)		if (drain_again)
	chk_logging_wakeup();		chk_logging_wakeup();