Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4bd5b5c3 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "diag: Add proper synchronization checks to msg mask table"

parents b9267f8a 851e9073

drivers/char/diag/diag_masks.c

+42 −17
Original line number Diff line number Diff line 
/* Copyright (c) 2008-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2008-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -308,7 +308,12 @@ static void diag_send_msg_mask_update(uint8_t peripheral, int first, int last) 
	if (!mask_info)

		return;



	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		mutex_unlock(&driver->msg_mask_lock);

		return;

	}

	buf = mask_info->update_buf;

	mutex_lock(&mask_info->lock);

	switch (mask_info->status) {
@@ -381,6 +386,7 @@ proceed: 
	}

err:

	mutex_unlock(&mask_info->lock);

	mutex_unlock(&driver->msg_mask_lock);

}



static void diag_send_time_sync_update(uint8_t peripheral)
@@ -493,6 +499,7 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, 
	if (!diag_apps_responds())

		return 0;



	mutex_lock(&driver->msg_mask_lock);

	rsp.cmd_code = DIAG_CMD_MSG_CONFIG;

	rsp.sub_cmd = DIAG_CMD_OP_GET_SSID_RANGE;

	rsp.status = MSG_STATUS_SUCCESS;
@@ -500,7 +507,6 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, 
	rsp.count = driver->msg_mask_tbl_count;

	memcpy(dest_buf, &rsp, sizeof(rsp));

	write_len += sizeof(rsp);



	mask_ptr = (struct diag_msg_mask_t *)mask_info->ptr;

	for (i = 0; i <  driver->msg_mask_tbl_count; i++, mask_ptr++) {

		if (write_len + sizeof(ssid_range) > dest_len) {
@@ -513,6 +519,7 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, 
		memcpy(dest_buf + write_len, &ssid_range, sizeof(ssid_range));

		write_len += sizeof(ssid_range);

	}

	mutex_unlock(&driver->msg_mask_lock);



	return write_len;

}
@@ -538,6 +545,7 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, 
	if (!diag_apps_responds())

		return 0;



	mutex_lock(&driver->msg_mask_lock);

	req = (struct diag_build_mask_req_t *)src_buf;

	rsp.cmd_code = DIAG_CMD_MSG_CONFIG;

	rsp.sub_cmd = DIAG_CMD_OP_GET_BUILD_MASK;
@@ -545,9 +553,8 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, 
	rsp.ssid_last = req->ssid_last;

	rsp.status = MSG_STATUS_FAIL;

	rsp.padding = 0;



	build_mask = (struct diag_msg_mask_t *)msg_bt_mask.ptr;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, build_mask++) {

	for (i = 0; i < driver->bt_msg_mask_tbl_count; i++, build_mask++) {

		if (build_mask->ssid_first != req->ssid_first)

			continue;

		num_entries = req->ssid_last - req->ssid_first + 1;
@@ -568,6 +575,7 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, 
	}

	memcpy(dest_buf, &rsp, sizeof(rsp));

	write_len += sizeof(rsp);

	mutex_unlock(&driver->msg_mask_lock);



	return write_len;

}
@@ -596,6 +604,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
	if (!diag_apps_responds())

		return 0;



	mutex_lock(&driver->msg_mask_lock);

	req = (struct diag_build_mask_req_t *)src_buf;

	rsp.cmd_code = DIAG_CMD_MSG_CONFIG;

	rsp.sub_cmd = DIAG_CMD_OP_GET_MSG_MASK;
@@ -603,7 +612,6 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
	rsp.ssid_last = req->ssid_last;

	rsp.status = MSG_STATUS_FAIL;

	rsp.padding = 0;



	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {

		if ((req->ssid_first < mask->ssid_first) ||
@@ -621,6 +629,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
	}

	memcpy(dest_buf, &rsp, sizeof(rsp));

	write_len += sizeof(rsp);

	mutex_unlock(&driver->msg_mask_lock);



	return write_len;

}
@@ -652,7 +661,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
	}



	req = (struct diag_msg_build_mask_t *)src_buf;



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&mask_info->lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
@@ -712,6 +721,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
		break;

	}

	mutex_unlock(&mask_info->lock);

	mutex_unlock(&driver->msg_mask_lock);



	if (diag_check_update(APPS_DATA))

		diag_update_userspace_clients(MSG_MASKS_TYPE);
@@ -766,6 +776,7 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 


	req = (struct diag_msg_config_rsp_t *)src_buf;



	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	mutex_lock(&mask_info->lock);

	mask_info->status = (req->rt_mask) ? DIAG_CTRL_MASK_ALL_ENABLED :
@@ -777,6 +788,7 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 
		mutex_unlock(&mask->lock);

	}

	mutex_unlock(&mask_info->lock);

	mutex_unlock(&driver->msg_mask_lock);



	if (diag_check_update(APPS_DATA))

		diag_update_userspace_clients(MSG_MASKS_TYPE);
@@ -1280,6 +1292,7 @@ static int diag_create_msg_mask_table(void) 
	struct diag_msg_mask_t *mask = (struct diag_msg_mask_t *)msg_mask.ptr;

	struct diag_ssid_range_t range;



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&msg_mask.lock);

	driver->msg_mask_tbl_count = MSG_MASK_TBL_CNT;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
@@ -1290,6 +1303,8 @@ static int diag_create_msg_mask_table(void) 
			break;

	}

	mutex_unlock(&msg_mask.lock);

	mutex_unlock(&driver->msg_mask_lock);



	return err;

}
@@ -1302,9 +1317,11 @@ static int diag_create_build_time_mask(void) 
	struct diag_msg_mask_t *build_mask = NULL;

	struct diag_ssid_range_t range;



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&msg_bt_mask.lock);

	driver->bt_msg_mask_tbl_count = MSG_MASK_TBL_CNT;

	build_mask = (struct diag_msg_mask_t *)msg_bt_mask.ptr;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, build_mask++) {

	for (i = 0; i < driver->bt_msg_mask_tbl_count; i++, build_mask++) {

		range.ssid_first = msg_mask_tbl[i].ssid_first;

		range.ssid_last = msg_mask_tbl[i].ssid_last;

		err = diag_create_msg_mask_table_entry(build_mask, &range);
@@ -1415,6 +1432,7 @@ static int diag_create_build_time_mask(void) 
		memcpy(build_mask->ptr, tbl, tbl_size);

	}

	mutex_unlock(&msg_bt_mask.lock);

	mutex_unlock(&driver->msg_mask_lock);



	return err;

}
@@ -1562,10 +1580,11 @@ static int diag_msg_mask_init(void) 
		pr_err("diag: Unable to create msg masks, err: %d\n", err);

		return err;

	}

	mutex_lock(&driver->msg_mask_lock);

	driver->msg_mask = &msg_mask;



	for (i = 0; i < NUM_PERIPHERALS; i++)

		driver->max_ssid_count[i] = 0;

	mutex_unlock(&driver->msg_mask_lock);



	return 0;

}
@@ -1584,7 +1603,7 @@ int diag_msg_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src) 
	err = __diag_mask_init(dest, MSG_MASK_SIZE, APPS_BUF_SIZE);

	if (err)

		return err;



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&dest->lock);

	src_mask = (struct diag_msg_mask_t *)src->ptr;

	dest_mask = (struct diag_msg_mask_t *)dest->ptr;
@@ -1603,6 +1622,7 @@ int diag_msg_mask_copy(struct diag_mask_info *dest, struct diag_mask_info *src) 
		dest_mask++;

	}

	mutex_unlock(&dest->lock);

	mutex_unlock(&driver->msg_mask_lock);



	return err;

}
@@ -1614,7 +1634,7 @@ void diag_msg_mask_free(struct diag_mask_info *mask_info) 


	if (!mask_info)

		return;



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&mask_info->lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
@@ -1622,7 +1642,7 @@ void diag_msg_mask_free(struct diag_mask_info *mask_info) 
		mask->ptr = NULL;

	}

	mutex_unlock(&mask_info->lock);



	mutex_unlock(&driver->msg_mask_lock);

	__diag_mask_exit(mask_info);

}
@@ -1630,15 +1650,17 @@ static void diag_msg_mask_exit(void) 
{

	int i;

	struct diag_msg_mask_t *mask = NULL;



	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)(msg_mask.ptr);

	if (mask) {

		for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++)

			kfree(mask->ptr);

		kfree(msg_mask.ptr);

		msg_mask.ptr = NULL;

	}



	kfree(msg_mask.update_buf);

	msg_mask.update_buf = NULL;

	mutex_unlock(&driver->msg_mask_lock);

}



static int diag_build_time_mask_init(void)
@@ -1663,13 +1685,15 @@ static void diag_build_time_mask_exit(void) 
{

	int i;

	struct diag_msg_mask_t *mask = NULL;



	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)(msg_bt_mask.ptr);

	if (mask) {

		for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++)

		for (i = 0; i < driver->bt_msg_mask_tbl_count; i++, mask++)

			kfree(mask->ptr);

		kfree(msg_mask.ptr);

		kfree(msg_bt_mask.ptr);

		msg_bt_mask.ptr = NULL;

	}

	mutex_unlock(&driver->msg_mask_lock);

}



static int diag_log_mask_init(void)
@@ -1787,7 +1811,7 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count, 
		return -EIO;

	}

	mutex_unlock(&driver->diag_maskclear_mutex);



	mutex_lock(&driver->msg_mask_lock);

	mutex_lock(&mask_info->lock);

	mask = (struct diag_msg_mask_t *)(mask_info->ptr);

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
@@ -1826,6 +1850,7 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count, 
		total_len += len;

	}

	mutex_unlock(&mask_info->lock);

	mutex_unlock(&driver->msg_mask_lock);



	return err ? err : total_len;

}

drivers/char/diag/diagchar.h

+2 −0
Original line number Diff line number Diff line
@@ -583,8 +583,10 @@ struct diagchar_dev { 
	struct diag_mask_info *event_mask;

	struct diag_mask_info *build_time_mask;

	uint8_t msg_mask_tbl_count;

	uint8_t bt_msg_mask_tbl_count;

	uint16_t event_mask_size;

	uint16_t last_event_id;

	struct mutex msg_mask_lock;

	/* Variables for Mask Centralization */

	uint16_t num_event_id[NUM_PERIPHERALS];

	uint32_t num_equip_id[NUM_PERIPHERALS];

drivers/char/diag/diagchar_core.c

+1 −0
Original line number Diff line number Diff line
@@ -3408,6 +3408,7 @@ static int __init diagchar_init(void) 
	mutex_init(&driver->diag_file_mutex);

	mutex_init(&driver->delayed_rsp_mutex);

	mutex_init(&apps_data_mutex);

	mutex_init(&driver->msg_mask_lock);

	for (i = 0; i < NUM_PERIPHERALS; i++)

		mutex_init(&driver->diagfwd_channel_mutex[i]);

	init_waitqueue_head(&driver->wait_q);

drivers/char/diag/diagfwd_cntl.c

+9 −5
Original line number Diff line number Diff line 
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -510,6 +510,7 @@ static void process_ssid_range_report(uint8_t *buf, uint32_t len, 
	/* Don't account for pkt_id and length */

	read_len += header_len - (2 * sizeof(uint32_t));



	mutex_lock(&driver->msg_mask_lock);

	driver->max_ssid_count[peripheral] = header->count;

	for (i = 0; i < header->count && read_len < len; i++) {

		ssid_range = (struct diag_ssid_range_t *)ptr;
@@ -553,6 +554,7 @@ static void process_ssid_range_report(uint8_t *buf, uint32_t len, 
		}

		driver->msg_mask_tbl_count += 1;

	}

	mutex_unlock(&driver->msg_mask_lock);

}



static void diag_build_time_mask_update(uint8_t *buf,
@@ -577,11 +579,11 @@ static void diag_build_time_mask_update(uint8_t *buf, 
		       __func__, range->ssid_first, range->ssid_last);

		return;

	}



	mutex_lock(&driver->msg_mask_lock);

	build_mask = (struct diag_msg_mask_t *)(driver->build_time_mask->ptr);

	num_items = range->ssid_last - range->ssid_first + 1;



	for (i = 0; i < driver->msg_mask_tbl_count; i++, build_mask++) {

	for (i = 0; i < driver->bt_msg_mask_tbl_count; i++, build_mask++) {

		if (build_mask->ssid_first != range->ssid_first)

			continue;

		found = 1;
@@ -600,7 +602,7 @@ static void diag_build_time_mask_update(uint8_t *buf, 


	if (found)

		goto end;

	new_size = (driver->msg_mask_tbl_count + 1) *

	new_size = (driver->bt_msg_mask_tbl_count + 1) *

		   sizeof(struct diag_msg_mask_t);

	temp = krealloc(driver->build_time_mask->ptr, new_size, GFP_KERNEL);

	if (!temp) {
@@ -615,8 +617,10 @@ static void diag_build_time_mask_update(uint8_t *buf, 
		       __func__, err);

		goto end;

	}

	driver->msg_mask_tbl_count += 1;

	driver->bt_msg_mask_tbl_count += 1;

end:

	mutex_unlock(&driver->msg_mask_lock);



	return;

}