Loading drivers/char/diag/diag_memorydevice.c +18 −1 Original line number Diff line number Diff line Loading @@ -174,7 +174,7 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx) return 0; } int diag_md_copy_to_user(char __user *buf, int *pret) int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size) { int i, j; Loading @@ -185,6 +185,7 @@ int diag_md_copy_to_user(char __user *buf, int *pret) unsigned long flags; struct diag_md_info *ch = NULL; struct diag_buf_tbl_t *entry = NULL; uint8_t drain_again = 0; for (i = 0; i < NUM_DIAG_MD_DEV && !err; i++) { ch = &diag_md[i]; Loading @@ -196,6 +197,19 @@ int diag_md_copy_to_user(char __user *buf, int *pret) * If the data is from remote processor, copy the remote * token first */ if (i > 0) { if ((ret + (3 * sizeof(int)) + entry->len) >= buf_size) { drain_again = 1; break; } } else { if ((ret + (2 * sizeof(int)) + entry->len) >= buf_size) { drain_again = 1; break; } } if (i > 0) { remote_token = diag_get_remote(i); err = copy_to_user(buf + ret, &remote_token, Loading Loading @@ -241,6 +255,9 @@ drop_data: *pret = ret; err = copy_to_user(buf + sizeof(int), (void *)&num_data, sizeof(int)); diag_ws_on_copy_complete(DIAG_WS_MUX); if (drain_again) chk_logging_wakeup(); return err; } Loading drivers/char/diag/diag_memorydevice.h +2 −2 Original line number Diff line number Diff line /* Copyright (c) 2014, The Linux Foundation. All rights reserved. /* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and Loading Loading @@ -51,5 +51,5 @@ void diag_md_open_all(void); void diag_md_close_all(void); int diag_md_register(int id, int ctx, struct diag_mux_ops *ops); int diag_md_write(int id, unsigned char *buf, int len, int ctx); int diag_md_copy_to_user(char __user *buf, int *pret); int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size); #endif drivers/char/diag/diagchar.h +1 −1 Original line number Diff line number Diff line Loading @@ -572,7 +572,7 @@ void diag_ws_on_copy_fail(int type); void diag_ws_on_copy_complete(int type); void diag_ws_reset(int type); void diag_ws_release(void); void chk_logging_wakeup(void); int diag_cmd_add_reg(struct diag_cmd_reg_entry_t *new_entry, uint8_t proc, int pid); struct diag_cmd_reg_entry_t *diag_cmd_search( Loading drivers/char/diag/diagchar_core.c +2 −2 Original line number Diff line number Diff line Loading @@ -2320,7 +2320,7 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, int index = -1, i = 0, ret = 0; int data_type; int copy_dci_data = 0; int exit_stat; int exit_stat = 0; int write_len = 0; for (i = 0; i < driver->num_clients; i++) Loading Loading @@ -2348,7 +2348,7 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, COPY_USER_SPACE_OR_EXIT(buf, data_type, sizeof(int)); /* place holder for number of data field */ ret += sizeof(int); exit_stat = diag_md_copy_to_user(buf, &ret); exit_stat = diag_md_copy_to_user(buf, &ret, count); goto exit; } else if (driver->data_ready[index] & USER_SPACE_DATA_TYPE) { /* In case, the thread wakes up and the logging mode is Loading Loading
drivers/char/diag/diag_memorydevice.c +18 −1 Original line number Diff line number Diff line Loading @@ -174,7 +174,7 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx) return 0; } int diag_md_copy_to_user(char __user *buf, int *pret) int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size) { int i, j; Loading @@ -185,6 +185,7 @@ int diag_md_copy_to_user(char __user *buf, int *pret) unsigned long flags; struct diag_md_info *ch = NULL; struct diag_buf_tbl_t *entry = NULL; uint8_t drain_again = 0; for (i = 0; i < NUM_DIAG_MD_DEV && !err; i++) { ch = &diag_md[i]; Loading @@ -196,6 +197,19 @@ int diag_md_copy_to_user(char __user *buf, int *pret) * If the data is from remote processor, copy the remote * token first */ if (i > 0) { if ((ret + (3 * sizeof(int)) + entry->len) >= buf_size) { drain_again = 1; break; } } else { if ((ret + (2 * sizeof(int)) + entry->len) >= buf_size) { drain_again = 1; break; } } if (i > 0) { remote_token = diag_get_remote(i); err = copy_to_user(buf + ret, &remote_token, Loading Loading @@ -241,6 +255,9 @@ drop_data: *pret = ret; err = copy_to_user(buf + sizeof(int), (void *)&num_data, sizeof(int)); diag_ws_on_copy_complete(DIAG_WS_MUX); if (drain_again) chk_logging_wakeup(); return err; } Loading
drivers/char/diag/diag_memorydevice.h +2 −2 Original line number Diff line number Diff line /* Copyright (c) 2014, The Linux Foundation. All rights reserved. /* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and Loading Loading @@ -51,5 +51,5 @@ void diag_md_open_all(void); void diag_md_close_all(void); int diag_md_register(int id, int ctx, struct diag_mux_ops *ops); int diag_md_write(int id, unsigned char *buf, int len, int ctx); int diag_md_copy_to_user(char __user *buf, int *pret); int diag_md_copy_to_user(char __user *buf, int *pret, size_t buf_size); #endif
drivers/char/diag/diagchar.h +1 −1 Original line number Diff line number Diff line Loading @@ -572,7 +572,7 @@ void diag_ws_on_copy_fail(int type); void diag_ws_on_copy_complete(int type); void diag_ws_reset(int type); void diag_ws_release(void); void chk_logging_wakeup(void); int diag_cmd_add_reg(struct diag_cmd_reg_entry_t *new_entry, uint8_t proc, int pid); struct diag_cmd_reg_entry_t *diag_cmd_search( Loading
drivers/char/diag/diagchar_core.c +2 −2 Original line number Diff line number Diff line Loading @@ -2320,7 +2320,7 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, int index = -1, i = 0, ret = 0; int data_type; int copy_dci_data = 0; int exit_stat; int exit_stat = 0; int write_len = 0; for (i = 0; i < driver->num_clients; i++) Loading Loading @@ -2348,7 +2348,7 @@ static ssize_t diagchar_read(struct file *file, char __user *buf, size_t count, COPY_USER_SPACE_OR_EXIT(buf, data_type, sizeof(int)); /* place holder for number of data field */ ret += sizeof(int); exit_stat = diag_md_copy_to_user(buf, &ret); exit_stat = diag_md_copy_to_user(buf, &ret, count); goto exit; } else if (driver->data_ready[index] & USER_SPACE_DATA_TYPE) { /* In case, the thread wakes up and the logging mode is Loading