Merge "diag: Prevent out-of-bound read while processing peripheral ctrl_pkt" (e649ce87) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/char/diag/diagfwd_cntl.c

+3 −1

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2020, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -886,6 +886,8 @@ void diag_cntl_process_read_data(struct diagfwd_info p_info, void buf,

		while (read_len + header_len < len) {
		ctrl_pkt = (struct diag_ctrl_pkt_header_t *)ptr;
		if ((read_len + header_len + ctrl_pkt->len) > len)
		return;
		switch (ctrl_pkt->pkt_id) {
		case DIAG_CTRL_MSG_REG:
		process_command_registration(ptr, ctrl_pkt->len,