evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

diag: Reallocate dci buffer with proper required capacity

Browse source 
DCI command buffer reallocation is not done properly with
required capacity. The patch reallocates the same buffer and
updated capacity properly with header and response length.

Change-Id: I7b5fd132b9241d0f1493bcb602a6b361e4ad9a04
Signed-off-by: Hardik Arya <harya@codeaurora.org>
This commit is contained in:
Hardik Arya 2019-05-10 15:41:24 +05:30 • committed by Gerrit - the friendly Code Review server
parent d5f8b8426c
commit ad33cbf95e
1 changed files with 12 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
drivers/char/diag/diag_dci.c
View file

@ -998,6 +998,7 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source,
unsigned char *temp = buf;
int save_req_uid = 0;
struct diag_dci_pkt_rsp_header_t pkt_rsp_header;
int header_len = sizeof(struct diag_dci_pkt_rsp_header_t);
if (!buf || len <= 0) {
pr_err("diag: Invalid pointer in %s\n", __func__);
@ -1066,23 +1067,24 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source,
mutex_lock(&rsp_buf->data_mutex);
/*
* Check if we can fit the data in the rsp buffer. The total length of
* the rsp is the rsp length (write_len) + DCI_PKT_RSP_TYPE header (int)
* + field for length (int) + delete_flag (uint8_t)
* the rsp is the rsp length (write_len) + dci response packet header
* length (sizeof(struct diag_dci_pkt_rsp_header_t))
*/
if ((rsp_buf->data_len + 9 + rsp_len) > rsp_buf->capacity) {
if ((rsp_buf->data_len + header_len + rsp_len) > rsp_buf->capacity) {
pr_alert("diag: create capacity for pkt rsp\n");
rsp_buf->capacity += 9 + rsp_len;
temp_buf = krealloc(rsp_buf->data, rsp_buf->capacity,
GFP_KERNEL);
temp_buf = vzalloc(rsp_buf->capacity + header_len + rsp_len);
if (!temp_buf) {
pr_err("diag: DCI realloc failed\n");
mutex_unlock(&rsp_buf->data_mutex);
mutex_unlock(&entry->buffers[data_source].buf_mutex);
mutex_unlock(&driver->dci_mutex);
return;
} else {
rsp_buf->data = temp_buf;
}
rsp_buf->capacity += header_len + rsp_len;
if (rsp_buf->capacity > rsp_buf->data_len)
memcpy(temp_buf, rsp_buf->data, rsp_buf->data_len);
vfree(rsp_buf->data);
rsp_buf->data = temp_buf;
}
/* Fill in packet response header information */
@ -1091,9 +1093,8 @@ void extract_dci_pkt_rsp(unsigned char *buf, int len, int data_source,
pkt_rsp_header.length = rsp_len + sizeof(int);
pkt_rsp_header.delete_flag = delete_flag;
pkt_rsp_header.uid = save_req_uid;
memcpy(rsp_buf->data + rsp_buf->data_len, &pkt_rsp_header,
sizeof(struct diag_dci_pkt_rsp_header_t));
rsp_buf->data_len += sizeof(struct diag_dci_pkt_rsp_header_t);
memcpy(rsp_buf->data + rsp_buf->data_len, &pkt_rsp_header, header_len);
rsp_buf->data_len += header_len;
memcpy(rsp_buf->data + rsp_buf->data_len, temp, rsp_len);
rsp_buf->data_len += rsp_len;
rsp_buf->data_source = data_source;