Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bfbe9b93 authored by Hardik Arya's avatar Hardik Arya
Browse files

diag: Add NULL pointer checks for mask info 



Currently there is a possibility of NULL pointer
dereference issue due to NULL pointers checks are
missing for mask info. The patch fixes the issue by
adding NULL pointer checks.

CRs-Fixed: 2108911
Change-Id: I097aeacc90c8d88034bf799ee4e398ddda5e23f1
Signed-off-by: default avatarHardik Arya <harya@codeaurora.org>
parent f38ea00b

drivers/char/diag/diag_masks.c

+120 −8
Original line number Diff line number Diff line
@@ -500,6 +500,11 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	if (!diag_apps_responds())

		return 0;
@@ -605,7 +610,11 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}



	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}

	if (!diag_apps_responds())

		return 0;
@@ -618,6 +627,12 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
	rsp.status = MSG_STATUS_FAIL;

	rsp.padding = 0;

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&driver->msg_mask_lock);

		return -EINVAL;

	}

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {

		if ((req->ssid_first < mask->ssid_first) ||

		    (req->ssid_first > mask->ssid_last_tools)) {
@@ -664,11 +679,23 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	req = (struct diag_msg_build_mask_t *)src_buf;

	mutex_lock(&mask_info->lock);

	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&driver->msg_mask_lock);

		mutex_unlock(&mask_info->lock);

		return -EINVAL;

	}

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {

		if (i < (driver->msg_mask_tbl_count - 1)) {

			mask_next = mask;
@@ -779,6 +806,11 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	req = (struct diag_msg_config_rsp_t *)src_buf;
@@ -786,6 +818,13 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 
	mutex_lock(&driver->msg_mask_lock);



	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&driver->msg_mask_lock);

		mutex_unlock(&mask_info->lock);

		return -EINVAL;

	}

	mask_info->status = (req->rt_mask) ? DIAG_CTRL_MASK_ALL_ENABLED :

					   DIAG_CTRL_MASK_ALL_DISABLED;

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
@@ -877,7 +916,11 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}



	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}

	req = (struct diag_event_mask_config_t *)src_buf;

	mask_len = EVENT_COUNT_TO_BYTES(req->num_bits);

	if (mask_len <= 0 || mask_len > event_mask.mask_len) {
@@ -933,6 +976,11 @@ static int diag_cmd_toggle_events(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	toggle = *(src_buf + 1);

	mutex_lock(&mask_info->lock);
@@ -988,6 +1036,11 @@ static int diag_cmd_get_log_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	if (!diag_apps_responds())

		return 0;
@@ -1007,6 +1060,11 @@ static int diag_cmd_get_log_mask(unsigned char *src_buf, int src_len, 
	write_len += rsp_header_len;



	log_item = (struct diag_log_mask_t *)mask_info->ptr;

	if (!log_item->ptr) {

		pr_err("diag: Invalid input in %s, mask: %pK\n",

			__func__, log_item);

		return -EINVAL;

	}

	for (i = 0; i < MAX_EQUIP_ID; i++, log_item++) {

		if (log_item->equip_id != req->equip_id)

			continue;
@@ -1114,11 +1172,20 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}

	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}



	req = (struct diag_log_config_req_t *)src_buf;

	read_len += req_header_len;

	mask = (struct diag_log_mask_t *)mask_info->ptr;



	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		return -EINVAL;

	}

	if (req->equip_id >= MAX_EQUIP_ID) {

		pr_err("diag: In %s, Invalid logging mask request, equip_id: %d\n",

		       __func__, req->equip_id);
@@ -1234,9 +1301,17 @@ static int diag_cmd_disable_log_mask(unsigned char *src_buf, int src_len, 
		       mask_info);

		return -EINVAL;

	}



	if (!mask_info->ptr) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK\n",

			__func__, mask_info->ptr);

		return -EINVAL;

	}

	mask = (struct diag_log_mask_t *)mask_info->ptr;



	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		return -EINVAL;

	}

	for (i = 0; i < MAX_EQUIP_ID; i++, mask++) {

		mutex_lock(&mask->lock);

		memset(mask->ptr, 0, mask->range);
@@ -1500,7 +1575,7 @@ static int __diag_mask_init(struct diag_mask_info *mask_info, int mask_len, 


static void __diag_mask_exit(struct diag_mask_info *mask_info)

{

	if (!mask_info)

	if (!mask_info || !mask_info->ptr)

		return;



	mutex_lock(&mask_info->lock);
@@ -1557,11 +1632,17 @@ void diag_log_mask_free(struct diag_mask_info *mask_info) 
	int i;

	struct diag_log_mask_t *mask = NULL;



	if (!mask_info)

	if (!mask_info || !mask_info->ptr)

		return;



	mutex_lock(&mask_info->lock);

	mask = (struct diag_log_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&mask_info->lock);

		return;

	}

	for (i = 0; i < MAX_EQUIP_ID; i++, mask++) {

		kfree(mask->ptr);

		mask->ptr = NULL;
@@ -1636,11 +1717,18 @@ void diag_msg_mask_free(struct diag_mask_info *mask_info) 
	int i;

	struct diag_msg_mask_t *mask = NULL;



	if (!mask_info)

	if (!mask_info || !mask_info->ptr)

		return;

	mutex_lock(&mask_info->lock);

	mutex_lock(&driver->msg_mask_lock);

	mask = (struct diag_msg_mask_t *)mask_info->ptr;

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&driver->msg_mask_lock);

		mutex_unlock(&mask_info->lock);

		return;

	}

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {

		kfree(mask->ptr);

		mask->ptr = NULL;
@@ -1807,6 +1895,11 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count, 
	if (!mask_info)

		return -EIO;



	if (!mask_info->ptr || !mask_info->update_buf) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK, mask_info->update_buf: %pK\n",

			__func__, mask_info->ptr, mask_info->update_buf);

		return -EINVAL;

	}

	mutex_lock(&driver->diag_maskclear_mutex);

	if (driver->mask_clear) {

		DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
@@ -1819,6 +1912,13 @@ int diag_copy_to_user_msg_mask(char __user *buf, size_t count, 
	mutex_lock(&driver->msg_mask_lock);



	mask = (struct diag_msg_mask_t *)(mask_info->ptr);

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&driver->msg_mask_lock);

		mutex_unlock(&mask_info->lock);

		return -EINVAL;

	}

	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {

		ptr = mask_info->update_buf;

		len = 0;
@@ -1879,8 +1979,20 @@ int diag_copy_to_user_log_mask(char __user *buf, size_t count, 
	if (!mask_info)

		return -EIO;



	if (!mask_info->ptr || !mask_info->update_buf) {

		pr_err("diag: In %s, invalid input mask_info->ptr: %pK, mask_info->update_buf: %pK\n",

			__func__, mask_info->ptr, mask_info->update_buf);

		return -EINVAL;

	}



	mutex_lock(&mask_info->lock);

	mask = (struct diag_log_mask_t *)(mask_info->ptr);

	if (!mask->ptr) {

		pr_err("diag: Invalid input in %s, mask->ptr: %pK\n",

			__func__, mask->ptr);

		mutex_unlock(&mask_info->lock);

		return -EINVAL;

	}

	for (i = 0; i < MAX_EQUIP_ID; i++, mask++) {

		ptr = mask_info->update_buf;

		len = 0;