R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

diag: Use correct size while reallocating for hdlc encoding

Browse Source 
Possibility of mismatch with realloc size against the buf size
can cause out of bound scenario. Prevent the same using
proper size for reallocation of hdlc encoding.

Change-Id: I0c0f822bc591af69b009967c89d378ac70f79678
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
This commit is contained in:
Manoj Prabhu B 2022-04-07 19:47:47 +05:30
parent a4238be009
commit 15f079d1d6
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
drivers/char/diag/diagfwd_peripheral.c
View File

@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2015-2019, 2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include <linux/slab.h>
#include <linux/err.h>
@ -179,7 +180,7 @@ static int diag_add_hdlc_encoding(unsigned char *dest_buf, int *dest_len,
static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
{
int i, ctx = 0, flag_64k = 0;
uint32_t max_size = 0;
uint32_t max_size = 0, realloc_len = 0;
unsigned long flags;
unsigned char *temp_buf = NULL;
struct diag_md_info *ch = NULL;
@ -223,20 +224,20 @@ static int check_bufsize_for_encoding(struct diagfwd_buf_t *buf, uint32_t len)
}
spin_unlock_irqrestore(&ch->lock, flags);
}
temp_buf = krealloc(buf->data, max_size +
APF_DIAG_PADDING,
if (flag_64k)
realloc_len = MAX_PERIPHERAL_HDLC_BUF_SZ;
else
realloc_len = MAX_PERIPHERAL_BUF_SZ;
temp_buf = krealloc(buf->data, realloc_len,
GFP_KERNEL);
if (!temp_buf) {
mutex_unlock(&driver->md_session_lock);
return -ENOMEM;
}
buf->data = temp_buf;
if (flag_64k)
buf->len = MAX_PERIPHERAL_HDLC_BUF_SZ;
else
buf->len = MAX_PERIPHERAL_BUF_SZ;
buf->len = realloc_len;
DIAG_LOG(DIAG_DEBUG_PERIPHERALS,
"diag: Reallocated data buffer: %pK with size: %d, max_buf_len: %d, p: %d, t: %d, n: %d\n",
temp_buf, max_size, buf->len,