Merge "diag: Add proper checks to fix possible out-of-bound issue" (9aa503ec) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/char/diag/diagchar_core.c

+19 −4

Original line number	Diff line number	Diff line
		@@ -966,6 +966,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len,
		else
		hdlc_disabled = driver->hdlc_disabled;
		if (hdlc_disabled) {
		if (len < 4) {
		pr_err("diag: In %s, invalid len: %d of non_hdlc pkt",
		__func__, len);
		return -EBADMSG;
		}
		payload = (uint16_t )(buf + 2);
		if (payload > DIAG_MAX_HDLC_BUF_SIZE) {
		pr_err("diag: Dropping packet, payload size is %d\n",
		@@ -974,11 +979,21 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len,
		}
		driver->hdlc_encode_buf_len = payload;
		/*
		* Adding 4 bytes for start (1 byte), version (1 byte) and
		* payload (2 bytes)
		* Adding 5 bytes for start (1 byte), version (1 byte),
		* payload (2 bytes) and end (1 byte)
		*/
		if (len == (payload + 5)) {
		/*
		* Adding 4 bytes for start (1 byte), version (1 byte)
		* and payload (2 bytes)
		*/
		memcpy(driver->hdlc_encode_buf, buf + 4, payload);
		goto send_data;
		} else {
		pr_err("diag: In %s, invalid len: %d of non_hdlc pkt",
		__func__, len);
		return -EBADMSG;
		}
		}

		if (hdlc_flag) {