Merge "diag: Add protection while allocating memory during usb write" (fa6cfb4c) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/char/diag/diag_usb.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -529,6 +529,7 @@ int diag_usb_write(int id, unsigned char *buf, int len, int ctxt)
		return diag_usb_write_ext(usb_info, buf, len, ctxt);
		}

		spin_lock_irqsave(&usb_info->write_lock, flags);
		req = diagmem_alloc(driver, sizeof(struct diag_request),
		usb_info->mempool);
		if (!req) {
		@@ -542,6 +543,7 @@ int diag_usb_write(int id, unsigned char *buf, int len, int ctxt)
		pr_err_ratelimited("diag: In %s, cannot retrieve USB write ptrs for USB channel %s\n",
		__func__, usb_info->name);
		diag_usb_buf_tbl_remove(usb_info, buf);
		spin_unlock_irqrestore(&usb_info->write_lock, flags);
		return -ENOMEM;
		}

		@@ -554,10 +556,10 @@ int diag_usb_write(int id, unsigned char *buf, int len, int ctxt)
		pr_debug_ratelimited("diag: USB ch %s is not connected\n",
		usb_info->name);
		diagmem_free(driver, req, usb_info->mempool);
		spin_unlock_irqrestore(&usb_info->write_lock, flags);
		return -ENODEV;
		}

		spin_lock_irqsave(&usb_info->write_lock, flags);
		if (diag_usb_buf_tbl_add(usb_info, buf, len, ctxt)) {
		DIAG_LOG(DIAG_DEBUG_MUX,
		"ERR! unable to add buf %pK to table\n",