Merge "diag: Fix to check for command length size" (2afdd4ae) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/char/diag/diagchar_core.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -965,6 +965,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len,
		hdlc_disabled = driver->hdlc_disabled;
		if (hdlc_disabled) {
		payload = (uint16_t )(buf + 2);
		if (payload > DIAG_MAX_HDLC_BUF_SIZE) {
		pr_err("diag: Dropping packet, payload size is %d\n",
		payload);
		return -EBADMSG;
		}
		driver->hdlc_encode_buf_len = payload;
		/*
		* Adding 4 bytes for start (1 byte), version (1 byte) and