Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a682e03a authored by Mohit Aggarwal's avatar Mohit Aggarwal
Browse files

diag: Synchronize command registration table access 



Currently, command registration table is being read
in debugfs without any protection which may lead to
access of stale entries. The patch takes care of the
issue by adding proper protection.

CRs-Fixed: 2032672
Change-Id: I6ae058c16873f9ed52ae6516a1a70fd6d2d0da80
Signed-off-by: default avatarMohit Aggarwal <maggarwa@codeaurora.org>
parent 43cc5f8b

drivers/char/diag/diag_debugfs.c

+5 −1
Original line number Original line Diff line number Diff line 
/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.

 *

 *

 * This program is free software; you can redistribute it and/or modify

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and

 * it under the terms of the GNU General Public License version 2 and
@@ -268,8 +268,10 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf, 
	struct list_head *temp;

	struct list_head *temp;

	struct diag_cmd_reg_t *item = NULL;

	struct diag_cmd_reg_t *item = NULL;





	mutex_lock(&driver->cmd_reg_mutex);

	if (diag_dbgfs_table_index == driver->cmd_reg_count) {

	if (diag_dbgfs_table_index == driver->cmd_reg_count) {

		diag_dbgfs_table_index = 0;

		diag_dbgfs_table_index = 0;

		mutex_unlock(&driver->cmd_reg_mutex);

		return 0;

		return 0;

	}

	}
@@ -278,6 +280,7 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf, 
	buf = kzalloc(sizeof(char) * buf_size, GFP_KERNEL);

	buf = kzalloc(sizeof(char) * buf_size, GFP_KERNEL);

	if (ZERO_OR_NULL_PTR(buf)) {

	if (ZERO_OR_NULL_PTR(buf)) {

		pr_err("diag: %s, Error allocating memory\n", __func__);

		pr_err("diag: %s, Error allocating memory\n", __func__);

		mutex_unlock(&driver->cmd_reg_mutex);

		return -ENOMEM;

		return -ENOMEM;

	}

	}

	buf_size = ksize(buf);

	buf_size = ksize(buf);
@@ -322,6 +325,7 @@ static ssize_t diag_dbgfs_read_table(struct file *file, char __user *ubuf, 
			break;

			break;

	}

	}

	diag_dbgfs_table_index = i;

	diag_dbgfs_table_index = i;

	mutex_unlock(&driver->cmd_reg_mutex);





	*ppos = 0;

	*ppos = 0;

	ret = simple_read_from_buffer(ubuf, count, ppos, buf, bytes_in_buffer);

	ret = simple_read_from_buffer(ubuf, count, ppos, buf, bytes_in_buffer);